- update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-157.0.0.10 - !24854 [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - !24846 [sync]ub/ubdevshm: Support for acquiring va is a sub-range of registered va - [sync]urma: fix ubcore_import_jetty_ex not dec vtpn use cnt and create tpid - ub/ubdevshm: Support for acquiring va is a sub-range of registered va - !24823 [sync]urma: use xarray for ubagg/ubcore session lookup - urma: use xarray for ubagg/ubcore session lookup - !24818 [sync]urma: make ratelimit burst configurable for ubcore/uburma/ubagg - urma: make ratelimit burst configurable for ubcore/uburma/ubagg - !24803 [sync]urma: use vzalloc for ubmad tjetty and ini_rtbuffer - urma: use vzalloc for ubmad tjetty and ini_rtbuffer - !24998 ub: udma: Adaptation Flush Done flag - !25046 [sync]urma: fill vtpn param in import jetty - !25045 [sync]urma: add check when RC jetty bind not RC tp_handle - [sync]urma: fill vtpn param in import jetty - !25020 [openEuler-24.03-LTS-SP4] ub: ubase & net: unic: 3 bugfixes - [sync]urma: add check when RC jetty bind not RC tp_handle - net:unic:Fixed the problem of storage device hardware version error - ub:ubase:Fixed the problem of CDMA Entity has not using USC - ub:ubase:Fixed the problem of storage device hardware version error - ub: udma: Adaptation Flush Done flag - !24941 [sync]urma: drop param_set_uint_minmax for ratelimit burst setters - urma: drop param_set_uint_minmax for ratelimit burst setters - The RISC-V architecture features have been updated. - Add basic support for lanxin SoC. - For more details, refer to the rvck-olk repository. - !25652 [sync]urma: add check type in free driver obj - [sync]urma: add check type in free driver obj - !26030 [sync] urma: ratelimit JFC cleanup error logs - !26029 [sync] urma: fix pointer API return value comments - urma: ratelimit JFC cleanup error logs - [sync]urma: fix pointer API return value comments - !26646 mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - mm/numa_remote: limit remote NUMA linear mapping to PMD granularity - !26586 [sync]urma: fix uobj_put race in uobj remove commit - urma: fix uobj_put race in uobj remove commit - !26197 [sync]urma: allow to set priority for urma_ping - urma: allow to set priority for urma_ping - !26170 urma: sync support dev/eid sharing mode - urma: support dev/eid sharing mode - !26825 [openEuler-24.03-LTS-SP4][Hygon]x86/cpu/hygon: fix performance regression for hygon platform - x86/cpu/hygon: fix performance regression for hygon platform - !26660 Fix CVE-2026-64561 - !26667 [sync]urma: reject set_opt when object is already activated - urma: reject set_opt when object is already activated - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available - !27157 urma: fix ubagg topology lookup for primary and port EIDs - urma: fix ubagg topology lookup for primary and port EIDs - urma: enable uburma irq handle threshold by default - !27081 urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: support stable uburma device numbers - urma: fix ipourma to be a proper L3 device and reset skb headers on rx - urma: defer uburma jfce heavy work out of irq top-half to tasklet - urma: prevent JFC event UAF after delete failure - !27474 [sync]urma: fix uobj UAF on partial batch destroy failure - urma: fix uobj UAF on partial batch destroy failure - !27440 [sync]urma: drop jfe lock around fasync_helper calls - !27442 [sync]urma: allow NO order type for UM with CTP - urma: allow NO order type for UM with CTP - urma: drop jfe lock around fasync_helper calls - !27382 [sync]urma: reject zero-length batch delete requests - !27357 [openEuler-24.03-LTS-SP4] sync CVE LTS and bugfix from OLK-6.6 - perf hisi-ptt: Fix header file reference error - perf tools: Add get_unaligned_leNN() - urma: reject zero-length batch delete requests - Bluetooth: ISO: hold sk properly in iso_conn_ready - Bluetooth: ISO: fix refcounting of iso_conn - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout - md/raid1,raid10: fix error-path detection with md_cloned_bio() - netfilter: nf_tables: clone set on flush only - netfilter: nft_set_pipapo: don't leak bad clone into future transaction - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path - netfilter: nft_set_pipapo: merge deactivate helper into caller - netfilter: nft_set_pipapo: prepare walk function for on-demand clone - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL - netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR - netfilter: nf_tables: missing objects with no memcg accounting - net/sched: cls_bpf: reject dev-bound programs bound to a different device - net: iptunnel: fix stale transport header during tunnel decapsulation - xfrm: Don't clobber inner headers when already set - net: pull headers in qdisc_pkt_len_segs_init() - net: qdisc_pkt_len_segs_init() cleanup - net: account for encap headers in qdisc pkt len - urma: fix use-after-free in bind_jetty error path - iommu/ummu: Fix CONFIG_CMA_ALIGNMENT not taking effect - iommu/ummu: Defer tid_xa insertion until after copy_to_user in ALLOC_TID - iommu/ummu: Fix UB_UMMU_BYPASSDEV Kconfig dependency - iommu/ummu: Remove unreachable NULL check after ummu_sva_master_get - iommu/ummu: Refactor mem fault irq by chip generation and fix UMAU DFX/DTLB - iommu/ummu: Fix permission leak after software state update failure - iommu/ummu: Optimize MAPT for multi block_base_size - iommu/ummu: Fix unit mismatch and unmap leak in map_pages - sockmap: Fix use-after-free in udp_bpf_recvmsg() - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - nbd: add pre_defined_connections module parameter for pre-created devices - nbd: remove queue freeze for newly created nbd from netlink path - nbd: factor out a nbd_genl_foreach_sock - nbd: remove queue freeze in nbd_add_socket - nbd: disallow NBD_SET_SOCK on an active device - Revert "nbd: simplify find_fallback() by removing redundant logic" - Revert "nbd: replace socks pointer array with xarray" - Revert "nbd: remove redundant num_connections boundary checks" - Revert "nbd: remove queue freeze in nbd_add_socket" - urma: fix tpid_uobj leak on import error path - urma: fix concurrent issue of device unregister and netns exit - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE - netfilter: ipset: make sure gc is properly stopped - ima: Instantiate file_truncate and path_truncate hooks - l2tp: fix tunnel and session refcount leak on seq_file release - mmc: vub300: fix use-after-free on probe failure - Drivers: hv: vmbus: use generic driver_override infrastructure - sctp: fix addr_wq_timer race in sctp_free_addr_wq() - net: usb: ipheth: fix carrier_work UAF on disconnect - libceph: fix multiple unsafe decodes in decode_locker() - mm/huge_memory: fix huge_zero_pfn race - audit: fix recursive locking deadlock in audit_dupe_exe() - audit: use 'unsigned int' instead of 'unsigned' - audit: widen ino fields to u64 - VFS/audit: introduce kern_path_parent() for audit - vhost_iotlb: bound map allocation in add_range - RDMA/nldev: Fix locking when accessing mr->pd - RDMA/core: Add an option to display driver-specific QPs in the rdmatool - media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work - i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() - i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler - i3c: mipi-i3c-hci: Consolidate spinlocks - net: Fix kabi breakage of struct sk_buff and inet_frag_queue - Bluetooth: L2CAP: copy RX timestamp to new fragments - net: Rename mono_delivery_time to tstamp_type for scalabilty - urma: fix jfc use_cnt leak and UAF in active jfs/jfr/jetty - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios - enic: fix tx_hang_reset use-after-free on device removal - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks - iomap: release pages on atomic dio size mismatch - ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT - ovl: check access to copy_file_range source with src mounter creds - iomap: guard io_size EOF trim against concurrent truncate underflow - KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - Bluetooth: sco: Fix a race condition in sco_sock_timeout() - Bluetooth: SCO: give the socket its own sco_conn reference - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF - bnxt: fix head underflow on XDP head-grow - net/mlx5: LAG, Fix off-by-one in single-FDB error rollback - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag - urma: verify the maximum value of a config - PCI: Check ROM header and data structure addr before accessing - PCI: Introduce named defines for PCI ROM - perf tools: Use perf_env__get_cpu_topology() in machine__resolve() - perf stat: Introduce perf_env__get_cpu_topology() to guard NULL env->cpu - bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs - bpf: Add bpf_cpumask_weight() kfunc - bpf: keep RVI cpumask kfunc separate - ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD - af_unix: Unlink scc_entry in unix_del_edge(). - serial: amba-pl011: synchronize DMA teardown - selinux: reject a permission value exceeding the class permission count - hwmon: (pmbus) Fix type confusion in notification logic - net/mlx5e: Fix publication race for priv->channel_stats[] - selinux: do not cancel a policy conversion that never started - selinux: reject a class permission count below its inherited common - urma: remove GENL_ADMIN_PERM for show system command - netfilter: nft_lookup: fix catchall element handling with inverted lookups - net: mana: Support holes in device list reply msg - net: mana: Allow variable size indirection table - net: mana: Avoid open coded arithmetic - RDMA/mana_ib: Prefer struct_size over open coded arithmetic - net: mana: Add flex array to struct mana_cfg_rx_steer_req_v2 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount - net/sched: serialize qdisc_rtab_list against concurrent get/put - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - eventfs: Use children field for rcu head and add memory barriers - netfilter: nf_tables: make nft_object rhltable per table - xfs: bounds-check buffer log item's dirty bitmap - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() - md/raid5: avoid R5_Overlap races while breaking stripe batches - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads - dm-verity: fix buffer overflow in FEC calculation - ipvs: revalidate ihl to prevent out-of-bounds access - netfilter: synproxy: fix unaligned memory access in timestamp adjustment - bpf: Fix netns reference imbalance in conntrack kfuncs - tcp: clear sock_ops cb flags before force-closing a child socket - net: gro: properly validate BIG TCP aggregation criteria - vhost: fix vhost_get_avail_idx for a non empty ring - Bluetooth: hci_sync: add conditional locking annotations - Bluetooth: hci_sync: Fix advertising data UAFs - netfilter: nf_conncount: fix zone comparison in tuple dedup - RDMA/bnxt_re: Proper rollback if the ioremap fails - ub:ubus: check int type cap bit before get vector num - ub:ubus: Adapt new chip submodule ID - ub:ubus: The validity of the token response packet length is verified - md/raid1,raid10: fix deadlock in read error recovery path - dmaengine: idxd: fix double free of wq, engine, and group structs - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds - ASoC: topology: Check PCM and DAI name strings before use - sched: Fix sparsemask_next() wrap-around termination - config: add CONFIG_TCP_AO=n to openeuler_defconfig for x86/arm64 - net/sched: fix kabi breakage in struct Qdisc - regulator: devres: fix devm_regulator_get_enable_read_voltage() return - net/tcp_sigpool: Use kref_get_unless_zero() - net/tcp_sigpool: Fix some off by one bugs - bpf: tcp: fix double sock release on batch realloc - thunderbolt: Bound the DROM dual link port number before indexing sw->ports - scsi: scsi_debug: Negate wrapped memcmp() result - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() - ptp: ocp: Fix board ID over-read - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - vhost: reset the vring metadata cache on vring reconfiguration - vsock/virtio: avoid refilling the RX queue after teardown - ovl: don't warn when the mount is completed from another user namespace - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet - net: atlantic: free RX pages of consumed but not refilled buffers - netfilter: bridge: release template ct on non-IP path - net: smc: fix splice entry lifetime imbalance in smc_rx_splice - fbdev: bitblit: bound-check glyph index in bit_cursor() - ALSA: usx2y: bound the hwdep mmap fault offset - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke - misc: fastrpc: Remove buffer from list prior to unmap operation - misc: fastrpc: fix channel ctx ref leak when session alloc fails - staging: rtl8723bs: validate monitor transmit frame lengths - staging: rtl8723bs: fix missing shared-key auth challenge length check - staging: rtl8723bs: fix OOB read in WMM_param_handler() - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() - serial: 8250_dma: Clear stale RX state on shutdown - mei: pull kvfree out of spinlock - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops - selftests/bpf: Adapt sockmap update error handling - fscrypt: Replace mk_users keyring with simple list - pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP - fortify: Disable -Wstringop-overread in tests - fortify: refactor test_fortify Makefile to fix some build problems - futex: Prevent robust futex exit race some more - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - KVM: s390: pci: Fix aisb calculation - KVM: s390: pci: Fix resource leak on IRQ registration failure - KVM: s390: pci: Fix missing error codes and memory unaccounting - net: bridge: mrp: fix uninitialised bytes on the wire - mac802154: fix netdev use-after-free in beacon worker - net: octeontx2-pf: Fix UB in shift operation - net/sched: reject overly deep qdisc hierarchies - net: openvswitch: reallocate update replies for mismatched IDs - ipvs: properly update the overload flag on dest edit - ipvs: add totalconns for dest - ima: fix out-of-bounds read in xattr_verify() - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get - vt: add permission check for KDSKBMETA ioctl - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() - usb: gadget: f_ncm: Use unsigned int for ndp_index - usb: cdnsp: fix incorrect endian conversions for APB timeout register - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() - ALSA: usb-audio: fix OOB write on Type II inbound URBs - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - net: fec: do not release NULL pages when RX buffer allocation fails - hwmon: (ads7828) Fix external VREF regulator handling - regulator: devres: add API for reference voltage supplies - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - tls: don't abort the connection on signal-interrupted sends - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() - net/tcp: Add TCP-AO config and structures - net/tcp: Prepare tcp_md5sig_pool for TCP-AO - ata: pata_sl82c105: fix bridge revision use-after-free - net: thunderbolt: Tear down DMA paths before stopping the rings - net/smc: fix TOCTOU race between smc_listen_out() and listener close - net: remove WARN_ON_ONCE() from sk_mc_loop() - net: prestera: validate firmware header length - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - bnxt_en: Fix PTP PPS setting bug - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - selftests/ftrace: refactor eprobes test to fix argument checks - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - hwmon: (lm25066) Use i2c_get_match_data() - hwmon: (nzxt-smart2) Check return value of init_device() in probe - net/openvswitch: check Ethernet header length in key_extract() - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - vhost/vdpa: reject overflowing PA map page counts on 32-bit - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() - bpf: tcp: Avoid socket skips and repeats during iteration - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items - bpf: tcp: Get rid of st_bucket_done - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch - counter: microchip-tcb-capture: Fix DT channel validation - net/mlx5: fw_tracer, return NULL on create error - devlink: fix net namespace reference leak in reload - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/sched: cls_route: fix fastmap use-after-free on filter - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() - btrfs: fix memory leak in btrfs_do_encoded_write() - netfilter: ipset: switch ext_size to atomic64_t - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - drm/bridge: ps8640: propagate AUX transfer register errors - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ARM: npcm: Fix OF node refcount leaks in SMP setup - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - selftests/bpf: Fail unbound UDP on sockmap update - mount: honour SB_NOUSER in the new mount API - packet: use consistent hard_header_len in TX_RING send path - packet: use consistent hard_header_len in non-ring send paths - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - tcp: challenge ACK for non-exact RST in SYN-RECEIVED - net: pktgen: fix proc entry use-after-free - entry: Fix seccomp bypass after ptrace with TSYNC - bpf: Simplify sanitize_err() signature - xfs: fix ilock leak on error in xfs_dq_get_next_id - mm/numa_remote: fix NUMA.remote and DRAM in the same memory tier - memory tier: fix deadlock warning while onlining pages - memory tier: consolidate the initialization of memory tiers - memory tier: create CPUless memory tiers after obtaining HMAT info - memory tier: dax/kmem: introduce an abstract layer for finding, allocating, and putting memory types - mm/demotion: print demotion targets - acpi,mm: fix typo sibiling -> sibling - bpf: Fix WARNING in bpf_tracing_link_release - bpf: Zero queue and stack outputs on lock failure - bpf: Clear buf on error in __bpf_get_task_stack - bpf: Reject negative optlen in cgroup getsockopt hook - fuse-uring: check connection abort during ring creation - fuse-uring: fix race between registration and connection abortion - iomap: fix out-of-bounds bitmap_set() with zero-length range - firewire: ohci: fix NULL pointer dereference in ar_context_release - ACPI: processor_idle: Mark LPI enter functions as __cpuidle - s390/vfio_ccw: Move cp cleanup out of not operational - s390/vfio_ccw: Cancel existing workqueues - openrisc: signal: do not restore privileged SR bits on sigreturn - s390/vfio_ccw: Ensure first IDAW remains constant - iommu/iommufd: Fix IOPF group ownership UAF - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). - ub: udma: fix a bug of log type. - inet: frags: strip GSO state from fragments before reassembly - sctp: fix err_chunk memory leaks in INIT handling - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call - bpf: Preserve pointer state for commuted arithmetic - tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg - inet: frags: publish queues before arming timer - inet: frags: save a pair of atomic operations in reassembly - inet: frags: change inet_frag_kill() to defer refcount updates - ipv4: frags: remove ipq_put() - inet: frags: add inet_frag_putn() helper - ipvs: clear IPv4 options after rebasing tunnel ICMP errors - veth: convert frag_list skbs before running XDP - tls: rx: restore msg_iter before TLS 1.3 optimistic retry - net/liquidio: drop cached VF pci_dev LUT - block: stop the timeout timer when releasing a never added disk - libceph: fix OOB read in decode_watchers() via missing bounds check - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp - bpf, sockmap: Fix sk_redir use-after-free in send verdict - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ipvs: stop estimator after disabled calc phase - perf: Reject exited events as group leaders - netfilter: ipset: fix refcount race between list:set GC and swap - tls: don't leave a full plaintext sk_msg ring unpushed - netfilter: nf_conntrack: defer invalid log until after unlock - vxlan: do not arm the ageing timer on a device that is down - ipv4: fix use-after-free in fib_nhc_update_mtu() - udp: fix potential use-after-free in tunnel segmentation - ceph: avoid fs reclaim while using current->journal_info - sctp: add INIT verification after cookie unpacking - sctp: clear control chunk transport if it is being removed - ub: cdma: use ST64B for direct SQE (DWQE) write in kernel path - net/packet: reset the MAC header on the packet-socket transmit path - ipv6: prevent in6_dev_get() from resurrecting inet6_dev - ipv6: fix Route Information option length validation - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev - sctp: fix use-after-free of cached ASCONF chunk - libceph: fix two unsafe bare decodes in decode_lockers() - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE - libceph: Amend checking to fix `make W=1` build breakage - tipc: read le->link under the node lock in tipc_node_link_down() - sctp: clear new_transport when removing a peer - mm/filemap: __filemap_add_folio() restore index before retrying - libceph: Avoid using invalid osd indices from primary_temp - ub: ubase: Fix mbox-over-cmdq seq reuse across driver - ub: ubase: Fix failure exception branch in UBASE cmd crq - ub: ubase: Recover the cmdq queue after reset failure - ub: ubase: fix probabilistic reset failure issue in - ub: ubase&udma: Add ubase forwarding tp flush done - net: unic: Reduce the wait time for loopback connection - net: unic: Add DMA cache sync for RX SGE buffers - sctp: validate cookie AUTH state before use - sctp: keep chunk->transport in step with the list it is queued on - vsock/virtio: read virtqueues under worker locks - smb: client: Fix use-after-free in cifs_try_adding_channels() - ceph: fix hanging __ceph_get_caps() with stale mds_wanted - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor - packet: synchronize pressure clearing with ring reconfiguration - net/sched: cls_u32: skip hash tables in u32_bind_class() - mptcp: avoid combining some incoming suboptions - netfilter: ebt_nflog: pin the NFLOG backend - net/sched: act_gact, act_police: range check the fallback control action - tcp: fix TFO max_qlen accounting across reuseport migration - macvlan: inherit needed_headroom and needed_tailroom from lowerdev - xfs: don't swallow dquot recovery verification errors - nvmet-tcp: fix page fragment cache leak in error path - crypto: hisilicon/sec2 - remove unused sec_ctx.hlf_q_num - crypto: hisilicon/sec2 - fix uninitialized type_supported in sec_create_qp_ctx - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - veth: fix skb length accounting after XDP frag adjustment - xdp: reject clones that overrun skb_shared_info tailroom - net: gro: fix double aggregation of flush-marked skbs - net: move skb_gro_receive_list from udp to core - bpf: Guard conntrack opts error writes - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() - mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch - ixgbe: do not configure xps for XDP queues - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry - xfrm: fix stale skb->prev after async crypto steals a GSO segment - net: atlantic: free stranded TX buffers on ring deinit - Input: evdev - sanitize event type index when fetching event masks - Bluetooth: hci_core: Fix UAF in hci_unregister_dev() - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() - perf/core: Fix group leader use-after-free after sibling detach - wifi: ieee80211: validate MLE common info length - eventfs: Fix use-after-free in eventfs_remove_rec() - tracing: Fix race between update_event_fields and, event_define_fields - net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() - bpf: Reset register bounds before narrowing retval range in check_mem_access() - Input: evdev - fix information leak in evdev_pass_values() - Bluetooth: ISO: fix leaking sk after socket release - binfmt_misc: restore write access when removing an entry - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ipvs: return the csum validation for forward hook - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - sysctl: fix kabi breakage of ctl_table_header constification - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info - ALSA: hda: codecs: hdmi: disable keep-alive before audio format change - drm/i915/hdcp: check streams[] bounds before overflow - drm/i915/hdcp: require monotonically increasing seq_num_v - drm/i915/hdcp: Move to using intel_display in intel_hdcp - drm/i915/hdcp: migrate away from kdev_to_i915() in bind/unbind - drm/i915/fbc: Extract intel_fbc_has_fences() - sctp: close UDP tunnel sockets during netns teardown - mptcp: pm: avoid code duplication to lookup endp - libceph: add doutc and *_client debug macros support - sctp: avoid auth_enable sysctl UAF during netns teardown - sysctl: treewide: constify ctl_table_header::ctl_table_arg - wifi: brcmfmac: drain bus_reset work on device removal - wifi: brcmfmac: set F2 blocksize to 256 for BCM43752 - wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW) - wifi: ath6kl: fix use-after-free in aggr_reset_state() - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() - media: v4l: async: Set owner for async sub-devices - media: i2c: imx219: Group functions by purpose - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Don't store the current mode in the imx219 structure - media: i2c: imx219: Access height from active format in imx219_set_ctrl - drm/i915/vrr: require valid min/max vfreq for VRR - drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() - drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions - usb: typec: ucsi: Fix race condition and ordering in port unregistration - usb: typec: ucsi: split connector lock classes - usb: typec: ucsi: Only enable supported notifications - usb: gadget: f_tcm: synchronize delayed set_alt with teardown - drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay - drm: renesas: Move RZ/G2L MIPI DSI driver to rz-du - usb: musb: omap2430: Do not put borrowed of_node in probe - usb: musb: omap2430: clean up probe error handling - Revert "ia64: Make acpi_cpufreq_cpu_exit return void" - firmware: stratix10-svc: fix memory leaks and list corruption bugs - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - ata: ahci: Make ahci_ignore_port() handle empty mask_port_map - ata: libahci_platform: Do not set mask_port_map when not needed - HID: logitech-dj: Fix maxfield check in DJ short report validation - spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX - drm/vmwgfx: validate external BO copy bounds for both stride paths - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: bound DMA command body size against suffix pointer - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: reject DX_BIND_QUERY without a DX context - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/amdkfd: hold event_mutex while checkpointing CRIU events - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/amdkfd: fix QID bit leak in pqm_create_queue() - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdgpu: cap GTT size to physical RAM on APUs - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/mediatek: ovl_adaptor: balance component registrations - drm/vc4: Zero the tile state data array before each BIN job - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - can: ctucanfd: mark error-active controller status valid - can: ctucanfd: handle bus error interrupts - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: peak_usb: validate uCAN receive record lengths - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error - can: peak_usb: add bounds check for USB channel index - can: softing: fw_parse(): validate firmware record spans - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure - can: ems_usb: validate CPC message lengths - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - i2c: imx: Cancel hrtimer before clearing slave pointer - i2c: imx: Fix slave registration race and error handling - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock - ice: fix memory leak in ice_lbtest_prepare_rings() - ice: wait for reset completion in ice_resume() - net: openvswitch: fix skb leak on flow key update failure during ct - net: openvswitch: fix skb leak on flow key update failure during recirculation - net: openvswitch: fix potential UAF on meter attach failure - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - s390/zcrypt: Validate length for CCA ECC private key requests - s390/zcrypt: Validate length for CCA AES cipher key requests - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/dasd: Fix undersized format-check buffer - s390/dasd: Fix potential NULL pointer dereference - s390/qeth: Check CAP_NET_ADMIN for private ioctls - power: supply: bq25890: fix the -10 C NTC lookup entry - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - i2c: amd-mp2: Unregister callback on adapter add failure - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - sctp: prevent peer transport count overflow - sctp: reject stale cookies with mismatched verification tags - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write - selftests/clone3: fix wild pointer access of getline due to missing init - selftests/mm: fix potential wild pointer access of getline due to missing init - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - tracing/filters: Fix false positive match in regex_match_full() - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() - vxlan: use neigh_ha_snapshot() in route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - vxlan: re-fetch eth header after route_shortcircuit() - um: vector: fix use-after-free in vector_mmsg_rx() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - binfmt_misc: reject a flag character as the field delimiter - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames - tipc: avoid use-after-free in poll trace queue dumps - netfilter: ipset: do not update comments from kernel-side hash adds - net/smc: fix socket use-after-free during link group termination - ipvs: do not propagate one-packet flag to synced conns - e1000: fix memory leak in e1000_probe() - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - ALSA: usb-audio: Clamp frame size in implicit-feedback mode - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ASoC: tas2562: fix broken entries in the volume lookup table - ASoC: tas2562: fix DVC coefficient write order - ALSA: ump: fix double free of out_cvts on rawmidi error - ALSA: pcm: wake linked drain waiters on unlink - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: 6fire: Fix UAF at error handling during probe - bpf: lwt: Fix dst reference leak on reroute failure - Bluetooth: HIDP: validate numbered report payloads - Bluetooth: HIDP: reject frames without a transaction header - Bluetooth: mgmt: fix UAF in pair command cancellation - Bluetooth: mgmt: fix pending command UAF in EIR updates - audit: fix potential use-after-free in audit_del_rule() - audit: fix potential integer overflow in audit_log_n_string() - sctp: validate Adaptation Indication parameter length - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active - tracing/probes: Reject $arg0 in meta argument expansion - mm/vmstat: fold stranded per-cpu node stats when a node comes online - mm/hugetlb: fix list corruption in allocate_file_region_entries() - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - pinctrl: bm1880: add missing select GENERIC_PINCONF - erofs: cap LZMA stream pool size - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump - ksmbd: fix use-after-free in __close_file_table_ids() - ksmbd: return success for deferred final close - qede: sync udp_tunnel ports outside qede_lock in the recovery path - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - accel/qaic: use sizeof(*trans_hdr) for transaction length check - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - can: isotp: check register_netdevice_notifier() error in module init - net: sxgbe: check descriptor ring allocation failures - net: sxgbe: free TX rings on RX allocation failure - scsi: target: Clear cmd_cnt when initial counter enrollment fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - net: phylink: put link_gpio if phylink_create fails - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: btintel: Validate length before parsing diagnostics TLV - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp - Bluetooth: ISO: clear iso_data always when detaching conn from hcon - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - wifi: mac80211: validate individual TWT params before driver setup - powerpc/boot: Fix treeboot-akebono CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix simpleboot CPU node lookup check - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - forcedeth: fix UAF of txrx_stats in nv_remove - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (nct6775-core) Prevent access to unsupported weight registers - hwmon: (nzxt-smart2) DMA-align output buffer - hwmon: (lm90) Only report alarms if driver is ready - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 - smb: client: fix buffer leaks in SMB1 read and write - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer - pinctrl-amd: Don't clear S4 wake bits at probe - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled - netfilter: nft_payload: fix mask build for partial field offload - ipvs: do not mangle ICMP replies for non-first fragments - ipvs: fix places with wrong packet offsets - ipvs: fix the checksum validations - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH - assoc_array: trim the final shortcut word using the current chunk end - keys: make keyring key-chunk byte order agree with keyring_diff_objects() - keys: fix out-of-bounds read in keyring_get_key_chunk() - drm/mediatek: Check CRTC state before freeing - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() - phy: zynqmp: fix runtime PM leak on probe allocation failure - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy-zynqmp: Postpone getting clock rate until actually needed - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - ahci: Introduce ahci_ignore_port() helper - ata: libahci_platform: support non-consecutive port numbers - ata: sata_mv: accept 1 or 2 resources in platform probe - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect - soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - gve: fix Rx queue stall on alloc failure - net: mpls: initialize rtm_tos in mpls_getroute() - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - nfs: use nfsi->rwsem to protect traversal of the file lock list - cifs: Fix busy dentry used during umounting - perf hisi-ptt: Fix spelling and abbreviation errors - perf hisi-ptt: Strengthen auxtrace event handling and packet type detection - perf hisi-ptt: Fix PTT trace TLP header parsing - perf hisi-ptt: remove unused struct 'hisi_ptt_queue' - tipc: serialize udp bearer replicast list updates - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() - mm/compaction: handle free_pages_prepare() properly in compaction_free() - bpf: Mask pseudo pointer values in verifier logs - mm/page_reporting: use system_freezable_wq to fix UAF during suspend - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling - LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages - net/handshake: Take a long-lived file reference at submit - riscv: Fix register corruption from uninitialized cregs on error - ub/ubdevshm: Bugfix for unregister segment - drop_monitor: perform u64_stats updates under IRQ-disabled section - vxlan: use pskb_network_may_pull() in route_shortcircuit() - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD - drop_monitor: fix size calculations for 64-bit attributes - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled - pinctrl: devicetree: don't free uninitialized dev_name on error path - btrfs: zoned: fix deadlock between metadata writeback and transaction commit - vxlan: use pskb_network_may_pull() for transmit path header pulls - bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable - net: do not send ICMP/NDISC Redirects when peer allocation fails - x86/bugs: Make Safe-RET robust against interrupt injection - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - iommu/ummu: Move the mmu notifier TLBi to driver layer - iommu/ummu: Add ummu platform erratum mechanism - iommu/ummu: Move ioplb_sync to flush.c - etmem: fix page reference leak in add_page_for_swap() - ub: cdma: cdma: fix umem leak in jfs user-path entry_cnt power-of-2 check - ub: cdma: fix AB-BA lock inversion deadlock and remove dead unmap code - ub: cdma: add RLIMIT_MEMLOCK/pinned_vm governance for user-space GUP pinning - ub: cdma: add power-of-2 check for jfc/jfs entry_cnt in user path - ub: cdma: fix UAF in debugfs show paths on queue->jfs/queue->jfc - net: bridge: stop fast-leave after deleting a port group - rxrpc: Fix irq-disabled in local_bh_enable() - Revert "drm/amdgpu: fix aperture mapping leak" - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - can: use skb hash instead of private variable in headroom - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug - rxrpc: Disable IRQ, not BH, to take the lock for ->attend_link - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() - ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() - ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link - mm/damon/core: disallow overlapping input ranges for damon_set_regions() - mm/damon/core: validate ranges in damon_set_regions() - net: ipa: fix SMEM state handle leaks in SMP2P init - net: macb: drop in-flight Tx SKBs on close - ata: libata-core: Reject an invalid concurrent positioning ranges count - octeontx2-pf: fix SQB pointer leak on init failure - ipmi: fix refcount leak in i_ipmi_request() - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: do not put quotes on cmdline items unless necessary - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF - gpio: mt7621: avoid corruption of shared interrupt trigger state - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink - net: mana: Validate the packet length reported by the NIC - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() - tracing/user_events: Fix use-after-free in user_event_mm_dup() - workqueue: Add system_percpu_wq and system_dfl_wq - workqueue: Factor out init_cpu_worker_pool() - Input: ims-pcu - fix firmware leak in async update - firmware_loader: introduce __free() cleanup hanler - dm-verity: make error counter atomic - dm-verity: avoid double increment of &use_bh_wq_enabled - ovl: use linked upper dentry in copy-up tmpfile - NFS: Charge unstable writes by request size, not folio size - nfs: remove dead code for the old swap over NFS implementation - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) - i2c: imx: separate atomic, dma and non-dma use case - platform/x86: dell-laptop: fix missing cleanups in init error path - platform/x86: dell-smbios: Move request functions for reuse - dmaengine: dw-edma-pcie: Reject devices without driver data - dmaengine: dw-edma: Fix confusing cleanup.h syntax - dma: dw-edma: Fix build warning in dw_edma_pcie_probe() - taskstats: retain dead thread stats in TGID queries - taskstats: fill_stats_for_tgid: use for_each_thread() - mtd: rawnand: Pause continuous reads at block boundaries - mtd: rawnand: Ensure all continuous terms are always in sync - mtd: rawnand: Add a helper for calculating a page index - mm/mm_init: fix pageblock migratetype for ZONE_DEVICE compound pages - SUNRPC: Return an error from xdr_buf_to_bvec() on overflow - SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists - sunrpc: allocate a separate bvec array for socket sends - NFSD: pass nfsd_file to nfsd_iter_read() - netfilter: nft_fib: reject fib expression on the netdev egress hook - netfilter: nf_tables: remove register tracking infrastructure - netfilter: nf_tables: Remove unused nft_reduce_is_readonly() - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it - netfilter: nf_conntrack_sip: remove net variable shadowing - netfilter: nft_set_pipapo: move prove_locking helper around - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions - ASoC: mediatek: mt8183: Check runtime resume during probe - ASoC: mediatek: mt8192: Check runtime resume during probe - ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable - ASoC: mediatek: Use common mtk_afe_pcm_platform with common probe cb - ASoC: mediatek: mt8192-afe-pcm: Simplify with dev_err_probe() - ASoC: mediatek: mt8192-afe-pcm: Convert to devm_pm_runtime_enable() - ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link - fbdev: efifb: fix memory leak in efifb_probe() - fbdev/efifb: Replace references to global screen_info by local pointer - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - octeontx2: Annotate mmio regions as __iomem - VDUSE: avoid leaking information to userspace - vduse: take out allocations from vduse_dev_alloc_coherent - vduse: remove unused vaddr parameter of vduse_domain_free_coherent - vduse: Use fixed 4KB bounce pages for non-4KB page size - rxrpc: Fix socket notification race - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Use irq-disabling spinlocks between app and I/O thread - rxrpc: Don't need barrier for ->tx_bottom and ->acks_hard_ack - tipc: restrict socket queue dumps in enqueue tracepoints - fbcon: Use correct type for vc_resize() return value - fbcon: Rename struct fbcon_ops to struct fbcon_par - rxrpc: serialize kernel accept preallocation with socket teardown - rxrpc: Pull out certain app callback funcs into an ops table - afs: Turn the afs_addr_list address array into an array of structs - afs: Annotate struct afs_addr_list with __counted_by - serial: max310x: implement gpio_chip::get_direction() - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - ALSA: hda: Fix cached processing coefficient verbs - ALSA: hda: conexant: Remove mic bias threshold override - i2c: davinci: Unregister cpufreq notifier on probe failure - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning - udmabuf: Do not create malformed scatterlists - net: pcs: xpcs: fix SGMII state reading - io_uring/rw: fix missing ERESTARTSYS conversion in read paths - drm/amd/display: Fix dcn32 DTB DTO update breaking live pixel rate sources - exfat: validate cluster allocation bits of the allocation bitmap - openvswitch: fix GSO userspace truncation underflow - ksmbd: validate ACE size against SID sub-authorities - ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL - ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl - net: qrtr: ns: Raise node count limit to 512 - drm/amdgpu: fix aperture mapping leak - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd - drm/amdgpu: fix division by zero with invalid uvd dimensions - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() - drm/amdgpu/vcn4: avoid rereading IB param length - drm/amdgpu/vce: fix integer overflow in image size - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx8: drop unecessary BUG_ON() - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() - drm/amd/pm: make pp_features read-only when scpm is enabled - vxlan: mdb: Fix source list corruption on a failed replace - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() - pppoe: reload header pointer after dev_hard_header() - mctp: serial: handle zero-length frames to prevent rx buffer overflow - mac802154: llsec: reject frames shorter than the authentication tag - mac802154: hold an interface reference across the scan worker - ila: reload IPv6 header after pskb_may_pull in checksum adjust - ice: use READ_ONCE() to access cached PHC time - ksmbd: defer destroy_previous_session() until after NTLM authentication - rbd: Reset positive result codes to zero in object map update path - net: hip04: fix RX buffer leak on build_skb failure - net/x25: fix use-after-free in x25_kill_by_neigh() - net/iucv: fix use-after-free of a severed iucv_path - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() - geneve: require CAP_NET_ADMIN in the device netns for changelink - net: slip: serialize receive against buffer reallocation - vxlan: require CAP_NET_ADMIN in the device netns for changelink - phonet: pep: fix use-after-free in pep_get_sb() - iommu/vt-d: Disallow SVA if page walk is not coherent - fscrypt: Add missing superblock check in find_or_insert_direct_key() - fs: preserve ACL_DONT_CACHE state in forget_cached_acl() - binfmt_elf_fdpic: only honour the first PT_INTERP - libceph: remove debugfs files before client teardown - libceph: Reject monmaps advertising zero monitors - libceph: refresh auth->authorizer_buf{,_len} after authorizer update - libceph: guard missing CRUSH type name lookup - libceph: Fix multiplication overflow in decode_new_up_state_weight() - libceph: bound get_version reply decode to front len - sctp: don't free the ASCONF's own transport in DEL-IP processing - mptcp: only set DATA_FIN when a mapping is present - mptcp: decrement subflows counter on failed passive join - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() - tracing: Fix resource leak on mmiotrace trace_pipe close - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev - intel_th: fix MSC output device reference leak - mei: bus: access mei_device under device_lock on cleanup - serial: sc16is7xx: implement gpio get_direction() callback - comedi: comedi_parport: deal with premature interrupt - x86/boot/compressed: Disable jump tables - LoongArch: Fix oops during single-step debugging - platform/loongarch: laptop: Explicitly reset bl_powered state when suspend - exec: fix unsigned loop counter wrap in transfer_args_to_stack() - Bluetooth: RFCOMM: Fix session UAF in set_termios - Bluetooth: hci_sync: Protect UUID list traversal - staging: rtl8723bs: fix inverted HT40 secondary channel offset - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() - wifi: brcmfmac: make release_scratchbuffers idempotent - wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses - wifi: wilc1000: validate assoc response length before subtracting header - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper - wifi: ath6kl: fix OOB access from firmware ADDBA window size - ALSA: seq: close a re-opened queue timer in the destructor - media: vpif_capture: fix OF node reference imbalance - media: vivid: check for vb2_is_busy() when toggling caps - media: vivid: add vivid_update_reduced_fps() - media: vimc: fix reference leak on failed device registration - media: vidtv: fix reference leak on failed device registration - media: vb2: use ssize_t for vb2_read/vb2_write - media: v4l2-ctrls: validate HEVC active reference counts - media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() - media: ti: vpe: unwind v4l2 device registration on probe error - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: sun4i-csi: Return queued buffers on start_streaming() failure - media: stm32: dcmi: unregister notifier on probe failure - media: saa7134: Fix a possible memory leak in saa7134_video_init1 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure - media: rtl2832: fix use-after-free in rtl2832_remove() - media: radio-si476x: Unregister v4l2_device on probe failure - media: pwc: Return queued buffers on start_streaming() failure - media: pwc: Drain fill_buf on start_streaming() failure - media: pci: dm1105: Free allocated workqueue - media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding - media: nxp: imx8-isi: Fix potential out-of-bounds issues - media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path - media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure - media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe - media: msi2500: Return queued buffers on start_streaming() failure - media: meson: vdec: Fix memory leak in error path of vdec_open - media: marvell-cam: fix missing pci_disable_device() on remove - media: cx23885: add ioremap return check and cleanup - media: cx231xx: fix devres lifetime - media: cedrus: skip invalid H.264 reference list entries - media: cedrus: Fix missing cleanup in error path - media: cedrus: clean up media device on probe failure - media: cec: seco: unregister adapter on IR probe failure - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - media: airspy: Return queued buffers on start_streaming() failure - drm/vc4: Prevent shader BO mappings from becoming writable - drm/vmwgfx: Validate vmw_surface_metadata::array_size - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved - drm/amd/display: set new_stream to NULL after release - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU - drm/i915/gem: Do not leak siblings[] on proto context error - drm/i915: Return NULL on error in active_instance - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() - drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference - drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips - drm/amdkfd: Check bounds in allocate_event_notification_slot - drm/radeon: fix r100_copy_blit for large BOs - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/i915/gem: Add missing nospec on parallel submit slot - drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 - drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT - drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older - drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers - drm/dp/mst: fix buffer overflows in sideband chunk accumulation - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers - drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() - ice: fix LAG recipe to profile association - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net: qrtr: restrict socket creation to the initial network namespace - ppp: annotate data races in ppp_generic - ppp: enable TX scatter-gather - ppp: convert to percpu netstats - ppp: use IFF_NO_QUEUE in virtual interfaces - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - octeontx2-vf: set TC flower flag on MCAM entry allocation - net: stmmac: enable the MAC on link up for all supported speeds - net: stmmac: reset residual action in L3L4 filters on delete - net: stmmac: fix l3l4 filter rejecting unsupported offload requests - tipc: fix u16 MTU truncation in media and bearer MTU validation - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets - sctp: auth: verify auth requirement when auth_chunk is NULL - net: dpaa: fix mode setting - net: hsr: fix memory leak on slave unregistration by removing synced VLANs - net: bridge: vlan: fix vlan range dumps starting with pvid - amt: make the head writable before rewriting the L2 header - amt: re-read skb header pointers after every pull - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning - wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() - wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() - wifi: mt76: mt7915: guard HE capability lookups - tipc: fix infinite loop in __tipc_nl_compat_dumpit - nexthop: initialize extack in nh_res_bucket_migrate() - gtp: check skb_pull_data() return in gtp1u_send_echo_resp() - selftests: openvswitch: add config file - selftests: af_unix: add USER_NS config - tls: device: push pending open record on splice EOF - sctp: validate stream count in sctp_process_strreset_inreq() - pds_core: check for workqueue allocation failure - pds_core: order completion reads after the ownership check - pds_core: yield the CPU while waiting for the adminq to drain - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - pds_core: reject component parameter in legacy firmware update - wifi: mac80211: recalculate TIM when a station enters power save - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() - iommu/amd: Bound the early ACPI HID map - wifi: mwifiex: bound uAP association event IEs to the event buffer - wan: wanxl: Only reset hardware after BAR mapping - nfp: Check resource mutex allocation - wifi: mac80211: tear down new links on vif update error path - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() - dpaa2-eth: put MAC endpoint device on disconnect - dpaa2-switch: put MAC endpoint device on disconnect - rds: drop incoming messages that cross network namespace boundaries - bonding: fix devconf_all NULL dereference when IPv6 is disabled - net/packet: avoid fanout hook re-registration after unregister - Bluetooth: btusb: validate Realtek vendor event length - hwmon: occ: validate poll response sensor blocks - smb: client: validate DFS referral PathConsumed - hwmon: (asus-ec-sensors) add missed handle for ENOMEM - hwmon: (asus-ec-sensors) fix EC read intervals - hwmon: (asus-ec-sensors) fix looping over banks while reading from EC - wifi: iwlwifi: mvm: fix read in wake packet notification handler - wifi: iwlwifi: mvm: validate SAR GEO response payload size - ASoC: cs35l56: Use complete_all() to signal init_completion - ASoC: cs35l56: Fix potential probe() deadlock - ASoC: cs35l56: Don't use devres to unregister component - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - ASoC: tas2781: bound firmware description string parsing - btrfs: free mapping node on duplicate reloc root insert - btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8 - wifi: carl9170: fix buffer overflow in rx_stream failover path - wifi: carl9170: fix OOB read from off-by-two in TX status handler - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler - wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() - hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop - hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - RISC-V: KVM: Serialize virtual interrupt pending state updates - Revert "drm/amd/display: Add missing kdoc for ALLM parameters" - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - USB: serial: option: add TDTECH MT5710-CN - USB: serial: keyspan_pda: fix data loss on receive throttling - USB: serial: ftdi_sio: add support for E+H FXA291 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: gadget: snps-udc: fix device name leak on probe failure - usb: gadget: printer: fix infinite loop in printer_read() - usb: gadget: f_midi: cancel pending IN work before freeing the midi object - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n - net/sched: act_tunnel_key: Defer dst_release to RCU callback - drm/i915/selftests: Fix GT PM sort comparators - ksmbd: validate compound request size before reading StructureSize2 - ksmbd: pin conn during async oplock break notification - can: j1939: fix lockless local-destination check - bpf, sockmap: Reject unhashed UDP sockets on sockmap update - powerpc/vtime: Initialize starttime at boot for native accounting - powerpc/time: Prepare to stop elapsing in dynticks-idle - sched/vtime: Get rid of generic vtime_task_switch() implementation - drm/i915/gt: use correct selftest config symbol - smb/client: handle overlapping allocated ranges in fallocate - Bluetooth: hci_qca: Clear memdump state on invalid dump size - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds - Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync - Bluetooth: qca: fix NVM tag length underflow in TLV parser - ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: use platform_get_irq() - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered - net/iucv: take a reference on the socket found in afiucv_hs_rcv() - ipv4: fib: free fib_alias with kfree_rcu() on insert error path - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - ASoC: cs42l43: Correct report for forced microphone jack - ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - wifi: cfg80211: bound element ID read when checking non-inheritance - wifi: brcmfmac: initialize SDIO data work before cleanup - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock - wifi: cfg80211: reject unsupported PMSR FTM location requests - wifi: cfg80211: validate PMSR FTM preamble range - wifi: cfg80211: validate PMSR measurement type data - wifi: nl80211: validate nested MBSSID IE blobs - wifi: nl80211: free RNR data on MBSSID mismatch - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() - wifi: libertas: fix memory leak in helper_firmware_cb() - wifi: mac80211_hwsim: clamp virtio RX length before skb_put - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() - wifi: cfg80211: cancel sched scan results work on unregister - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() - RDMA/irdma: Prevent overflows in memory contiguity checks - selftests/alsa: Fix memory leak in find_controls error path - mtd: fix double free and WARN_ON in add_mtd_device() error paths - RDMA/siw: publish QP after initialization - RDMA/siw: Only check attrs->cap.max_send_wr in siw_create_qp - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - RDMA/erdma: initialize ret for empty receive WR lists - RDMA/irdma: Prevent rereg_mr for non-mem regions - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Add support for creating pinned DMABUF umem with a given dma device - RDMA/cma: Fix hardware address comparison length in netevent callback - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() - btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() - btrfs: reject free space cache with more entries than pages - mtd: nand: mtk-ecc: stop on ECC idle timeouts - mtd: mtdswap: remove debugfs stats file on teardown - IB/mad: Drop unmatched RMPP responses before reassembly - arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234 - Input: ims-pcu - fix logic error in packet reset - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() - xprtrdma: Clear receive-side ownership pointers on release - gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings - accel/ivpu: Reject firmware log with size smaller than header - dmaengine: sh: rz-dmac: Move interrupt request after everything is set up - can: isotp: serialize TX state transitions under so->rx_lock - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER - can: bcm: track a single source interface for ANYDEV timeout/throttle ops - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() - can: bcm: fix stale rx/tx ops after device removal - can: bcm: add missing device refcount for CAN filter removal - can: bcm: validate frame length in bcm_rx_setup() for RTR replies - can: bcm: extend bcm_tx_lock usage for data and timer updates - can: bcm: fix CAN frame rx/tx statistics - can: bcm: add locking when updating filter and timer values - KVM: x86/mmu: Fix use-after-free on vendor module reload - seqlock: Allow UBSAN_ALIGNMENT to fail optimizing - seqlock: Allow KASAN to fail optimizing - seqlock: Cure some more scoped_seqlock() optimization fails - drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker - USB: serial: io_edgeport: cap received transmit credits - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL - ub: udma: use memory pool to manage reserved va. - ub: udma: fix safe mode related problem. - ub: udma: Adapt the SVM to query the PASpace interface. - iommu/ummu: Move the path of the hisi_ummu.h file - iommu/ummu: Write UMAU mem attr bits into ATE start_addr - iommu/ummu: Strengthen ummu_idx_mask validation in tdev attr check - iommu/ummu: Update page table granule handling for UMAU - iommu/ummu: Refactor EID bypass tecte construction - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() - tracing: Check return value of __register_event() in trace_module_add_events() - libceph: reject zero bucket types in crush_decode - rhashtable: clear stale iter->p on table restart - drm/virtio: bound EDID block reads to the response buffer - drm/nouveau: fix reversed error cleanup order in ucopy functions - ub/ubmem-vmmu: Fix parameter validation and initialization issues. - ub: udma: fix log print problem. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions - smb: client: require net admin for CIFS SWN netlink - genetlink: Use internal flags for multicast groups - net: ipv6: clear suppressed fib6 rule result - igbvf: Fix leak in TX DMA error cleanup - sctp: fix auth_hmacs array size in struct sctp_cookie - fscrypt: Avoid dynamic allocation in fscrypt_get_devices() - binfmt_misc: set have_execfd only once the interpreter is opened - sctp: validate embedded INIT chunk and address list lengths in cookie - i2c: core: fix adapter deregistration race - netfilter: nf_tables: add hook transactions for device deletions - netfilter: x_tables: add and use xtables_unregister_table_exit - netfilter: x_tables: add and use xt_unregister_table_pre_exit - netfilter: x_tables: allocate hook ops while under mutex - netfilter: x_tables: allow initial table replace without emitting audit log message - firewire: net: Fix fragmented datagram reassembly - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - net: sysfs: fix locking in carrier read - net: core: synchronize link-watch when carrier is queried - x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled - mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one - KVM: nVMX: Hide shadow VMCS right after VMCLEAR - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length - hfs/hfsplus: prevent getting negative values of offset/length - ring-buffer: Use current_context for safe per-CPU buffer swap - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - mm: refactor mm_access() to not return NULL - bpf, cgroup: Fix storage null-ptr-deref after replacing prog - md/raid5: implement pers->bitmap_sector() - nvme: move error logging from nvme_end_req() to __nvme_end_req() - block: change blk_mq_add_to_batch() third argument type to bool - block: cleanup and fix batch completion adding conditions - esp: fix page frag reference leak on skb_to_sgvec failure - Revert "esp: fix page frag reference leak on skb_to_sgvec failure" - esp: fix page frag reference leak on skb_to_sgvec failure - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - ipv6/addrconf: annotate data-races around devconf fields (II) - x86/bugs: Enable IBPB flush on BPF JIT allocation - arm64: rsi: skip NS IPA alias addresses in arm64_rsi_is_protected - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - obmm: bound the local-node iterator and gatekeeper predicate by OBMM_MAX_LOCAL_NUMA_NODES - obmm: register /dev/obmm after subsystem init - obmm: mirror selected helpers' Kconfig dependencies - obmm: log preimport rollback and resource-release failures - obmm: accumulate nr_freed across reclaim notifiers - obmm: fix use-after-free in conti_free_memory debug print - ub: ubase&unic: fix an issue where logs are printed in - ub: ubase: Resolve the EQ destruction timeout issue - ub: ubase: Resolved the issue that the cmdq resources are - net: unic: Error scenarios in the IP management need to - net: unic: Abnormal cqe debugfs does not show status 0x0 - ub: ubase: Add UNIC/CDMA support for DTU init - ub: ubase: Resolve working queue may be scheduled after - net: unic: JFC Destroy Process Adaptation - Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() - Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle - Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state - Bluetooth: separate CIS_LINK and BIS_LINK link types - ub: cdma: fix ioctl vs remove race by widening ctx_mutex scope - ub: cdma: revert cdma_ioctl to pre-security-fix version - ub: cdma: fix UAF in mmu notifier release/unregister path - ub: cdma: fix security vulnerabilities in event/ioctl paths - ub: cdma: fix security vulnerabilities in ioctl/mmap/event/mmu paths - ub: cdma: add a process to update the adev status in cdma_probe - ethtool: rss: fix indir_table and hkey leak on get_rxfh failure - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - erofs: fix metabuf leak in inode xattr initialization - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU - drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages - drm/amdgpu: fix amdgpu_hmm_range_get_pages - crypto: qat - remove unused character device and IOCTLs - irqchip/irq-gic-v4: Fix state inconsistency in same_affinity_group - cgroup/rstat: validate cpu before css_rstat_cpu() access - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - sched/soft_domain: Fix NULL deref in unset and move ctx inheritance to online - KVM: SEV: Ignore Port I/O requests of length '0' - net/mlx5e: xsk: Fix unlocked writing to ICOSQ - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - KVM: x86: Unconditionally recompute CR8 intercept on PPR update - KVM: x86: Move update_cr8_intercept() to lapic.c - ipv6: ndisc: fix NULL deref in accept_untracked_na() - bpf: Copy per-CPU map value padding in copy_map_value_long() - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req - nbd: skip the capacity-change printk on device bringup and release - vfio: Remove device debugfs before releasing devres - i2c: i801: fix hardware state machine corruption in error path - netpoll: fix a use-after-free on shutdown path - drivers/ub/sentry: avoid unaligned cast in cis_ubios_remote_msg_cb() - drivers/ub/sentry: add NULL check for g_kbuf_server_cna in proc show handler - drivers/ub/sentry: add count == 0 check in proc write handlers - drivers/ub/sentry: add bounds check for reason in oom_rate_limit_check() - drivers/ub/sentry: fix NULL pointer dereference in str_to_eid() error path - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset.c: Adapt schduler dynamic affinity for hotplug scenarios with cgroup v2 - cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals - cpuset: Fix prefer_cpus ineffectiveness by tracking prefer_cpus - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms - proc: Fix broken error paths for namespace links - selftests/bpf: Add simple strscpy() implementation - tools/testing: add linux/args.h header and fix radix, VMA tests - jiffies: Cast to unsigned long in secs_to_jiffies() conversion - jiffies: Define secs_to_jiffies() - xfs: fix stupid compiler warning - Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder - selftests/hid: ensure CKI can compile our new tests on old kernels - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev - ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd - seqlock: fix scoped_seqlock_read kernel-doc - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers - Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO - exfat: preserve benign secondary entries during rename and move - exfat: move exfat_chain_set() out of __exfat_resolve_path() - exfat: add exfat_get_dentry_set_by_ei() helper - exfat: rename argument name for exfat_move_file and exfat_rename_file - exfat: remove unnecessary read entry in __exfat_rename() - exfat: move free cluster out of exfat_init_ext_entry() - regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() - regulator: scmi: Simplify with scoped for each OF child loop - audit: fix potential integer overflow in audit_log_n_hex() - audit: add audit_log_nf_skb helper function - crypto: qat - fix restarting state leak on allocation failure - btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC - usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile - nvmet: remove superfluous initialization - usb: gadget: f_fs: initialize reset_work at allocation time - crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A - crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 - usb: typec: tcpm: Fix VDM type for Enter Mode commands - usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() - serial: 8250_mid: Disable DMA for selected platforms - serial: 8250_mid: Remove 8250_pci usage - HID: appleir: fix UAF on pending key_up_timer in remove() - treewide: Switch/rename to timer_delete[_sync]() - proc: protect ptrace_may_access() with exec_update_lock (part 1) - seqlock: Change do_task_stat() to use scoped_seqlock_read() - seqlock: Introduce scoped_seqlock_read() - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled - HID: add haptics page defines - perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() - ksmbd: track the connection owning a byte-range lock - ksmbd: centralize ksmbd_conn final release to plug transport leak - ksmbd: use opener credentials for FSCTL mutations - smb: client: resolve SWN tcon from live registrations - smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - netfilter: ebtables: zero chainstack array - netfilter: ebtables: Use vmalloc_array() to improve code - media: nxp: imx8-isi: Fix use-after-free on remove - media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code - media: nxp: imx8-isi: Convert to platform remove callback returning void - gpio: sch: use raw_spinlock_t in the irq startup path - coresight: etb10: restore atomic_t for shared reading state - mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() - staging: rtl8723bs: fix spaces around binary operators - staging: rtl8723bs: core: move constants to right side in comparison - PCI: Free saved list without holding pci_bus_sem - PCI: Prevent resource tree corruption when BAR resize fails - PCI: mediatek: Fix IRQ domain leak when port fails to enable - PCI: mediatek: Use generic MACRO for TPVPERL delay - PCI: mediatek: Convert bool to single quirks entry and bitmap - PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() - PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling - vfio/mlx5: Fix racy bitfields and tighten struct layout - PCI: altera: Fix resource leaks on probe failure - ALSA: aoa: check snd_ctl_new1() return value - iio: common: st_sensors: honour channel endianness in read_axis_data - iio: pressure: mpl115: fix runtime PM leak on read error - iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading - iio: imu: inv_icm42600: stabilized timestamp in interrupt - iio: invensense: fix timestamp glitches when switching frequency - iio: invensense: remove redundant initialization of variable period - iio: hid-sensor-rotation: Fix stale or zero output when reading raw values - iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ - ACPI: NFIT: core: Fix possible deadlock and missing notifications - ACPI: NFIT: core: Use devm_acpi_install_notify_handler() - ACPI: bus: Introduce devm_acpi_install_notify_handler() - ACPI: driver: Check ACPI_COMPANION() against NULL during probe - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup - perf/x86/amd/brs: Fix kernel address leakage - mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout - mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout - mtd: rawnand: fsl_ifc: return errors for failed page reads - mmc: vub300: defer reset until cmd_mutex is unlocked - mtd: mchp23k256: use SPI match data for chip caps - mtd: onenand: samsung: report DMA completion timeouts - wifi: mwifiex: fix permanently busy scans after multiple roam iterations - wifi: mac80211: free ack status frame on TX header build failure - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() - reset: sunxi: fix memory region leak on ioremap failure - ipvs: reload ip header after head reallocation - ipvs: fix more places with wrong ipv6 transport offsets - memstick: ms_block: reject a card that reports too many blocks - macsec: fix promiscuity refcount leak in macsec_dev_open() - llc: fix SAP refcount leak when creating incoming sockets - Bluetooth: btrtl: validate firmware patch bounds - regulator: ltc3676: Fix incorrect IRQSTAT bit offsets - wifi: mac80211: fix memory leak in ieee80211_register_hw() - wifi: rt2x00: avoid full teardown before work setup in probe - powerpc/pseries: fix memory leak on krealloc failure in papr_init - pmdomain: imx: Fix i.MX8MP VC8000E power up sequence - pmdomain: imx: Fix i.MX8MP power notifier - cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - tracing/osnoise: Call synchronize_rcu() when unregistering - riscv: Prevent NULL pointer dereference in machine_kexec_prepare() - drbd: reject data replies with an out-of-range payload size - macsec: don't read an unset MAC header in macsec_encrypt() - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new - ipvs: use parsed transport offset in SCTP state lookup - llc: fix SAP refcount leak in llc_ui_autobind() - mac802154: remove interfaces with RCU list deletion - s390/monwriter: Reject buffer reuse with different data length - riscv: probes: save original sp in rethook trampoline - hwmon: (asus_atk0110) Check package count before accessing element - net: wwan: iosm: bound device offsets in the MUX downlink decoder - ata: pata_pxa: Fix DMA channel leak on probe error - orangefs: keep the readdir entry size 64-bit in fill_from_part() - tracing/probes: Fix double addition of offset for @+FOFFSET - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: lan743x: Initialize eth_syslock spinlock before use - fsl/fman: Free init resources on KeyGen failure in fman_init() - hwmon: (occ) unregister sysfs devices outside occ lock - net: liquidio: fix BAR resource leak on PF number failure - hwmon: (w83793) remove vrm sysfs file on probe failure - hwmon: (w83627hf) remove VID sysfs files on error and remove - rtc: mpfs: fix counter upload completion condition - bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() - espintcp: use sk_msg_free_partial to fix partial send - LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() - batman-adv: clean untagged VLAN on netdev registration failure - batman-adv: ensure minimal ethernet header on TX - batman-adv: retrieve ethhdr after potential skb realloc on RX - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit - ieee802154: ca8210: fix cas_ctl leak on spi_async failure - ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation - ieee802154: admin-gate legacy LLSEC dump operations - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink - net: ipip: require CAP_NET_ADMIN in the device netns for changelink - net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink - net: ena: clean up XDP TX queues when regular TX setup fails - net/sched: act_ct: preserve tc_skb_cb across defragmentation - net: ixp4xx_hss: fix duplicate HDLC netdev allocation - net: wwan: t7xx: destroy DMA pool on CLDMA late init failure - net: sit: require CAP_NET_ADMIN in the device netns for changelink - gpios: palmas: add .get_direction() op - gpio-f7188x: Add support for NCT6126D version B - cpu: hotplug: Bound hotplug states sysfs output - cpu: hotplug: Preserve per instance callback errors - posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete - Input: ims-pcu - fix type confusion in CDC union descriptor parsing - Input: ims-pcu - fix race condition in reset_device sysfs callback - Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing - Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging - Input: ims-pcu - fix DMA mapping violation in line setup - Input: ims-pcu - add response length checks - Input: ims-pcu - validate control endpoint type - Input: ims-pcu - release data interface on disconnect - Input: ims-pcu - fix use-after-free and double-free in disconnect - scsi: elx: efct: Fix I/O leak on unsupported additional CDB - scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE - scsi: target: Bound PR-OUT TransportID parsing to the received buffer - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it - scsi: xen: scsiback: Free the command tag on the TMR submit-failure path - scsi: sg: Report request-table problems when any status is set - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path - dm-verity: increase sprintf buffer size - dm-verity: fix a possible NULL pointer dereference - dm-integrity: don't increment hash_offset twice - dm_early_create: fix freeing used table on dm_resume failure - dm-stats: fix merge accounting - dm-stats: fix dm_jiffies_to_msec64 - dm-log: fix a bitset_size overflow on 32bit machines - dm-ioctl: fix a possible overflow in list_version_get_info - dm-bufio: fix wrong count calculation in dm_bufio_issue_discard - dm era: fix out-of-bounds memory access for non-zero start sector - dm thin metadata: fix metadata snapshot consistency on commit failure - dm thin metadata: fix superblock refcount leak on snapshot shadow failure - net: sparx5: unregister blocking notifier on init failure - bpf: Add missing access_ok call to copy_user_syms - can: bcm: add missing rcu list annotations and operations - can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF - can: isotp: use unconditional synchronize_rcu() in isotp_release() - can: esd_usb: kill anchored URBs before freeing netdevs - nvmet-rdma: handle inline data with a nonzero offset - sctp: validate STALE_COOKIE cause length before reading staleness - spi: uniphier: Fix completion initialization order before devm_request_irq() - tpm: Make the TPM character devices non-seekable - tpm: fix event_size output in tpm1_binary_bios_measurements_show - xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink - xfrm: use compat translator only for u64 alignment mismatch - xen/gntdev: fix error handling in ioctl - ice: fix ice_init_link() error return preventing probe - i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() - i2c: mediatek: fix WRRD for SoCs without auto_restart option - hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig - ksmbd: fix integer overflow in set_file_allocation_info() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops - platform/x86/amd/pmc: Check for intermediate wakeup in function - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK - dmaengine: tegra: Fix burst size calculation - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() - irqchip/crossbar: Use correct index in crossbar_domain_free() - mtd: maps: vmu-flash: fix NULL pointer dereference in initialization - mtd: spi-nor: swp: Improve locking user experience - fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() - net: thunderbolt: Fix frags[] overflow by bounding frame_count - bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path - fpga: dfl: add bounds check in dfh_get_param_size() - ocfs2: reject non-inline dinodes with i_size and zero i_clusters - ocfs2: reject dinodes whose i_rdev disagrees with the file type - ocfs2: reject dinodes with non-canonical i_mode type - ocfs2: add journal NULL check in ocfs2_checkpoint_inode() - ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits - ocfs2: avoid moving extents to occupied clusters - mtd: rawnand: fix condition in 'nand_select_target()' - net/9p: fix infinite loop in p9_client_rpc on fatal signal - mtd: rawnand: pl353: fix probe resource allocation - ocfs2: use kzalloc for quota recovery bitmap allocation - scsi: sas: Skip opt_sectors when DMA reports no real optimization hint - scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() - 9p: skip nlink update in cacheless mode to fix WARN_ON - mtd: slram: remove failed entries from the device list - mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE - proc: only bump parent nlink when registering directories - mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error - mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() - riscv: cacheinfo: Fix node reference leak in populate_cache_leaves - mips: sched: Fix CPUMASK_OFFSTACK memory corruption - power: supply: charger-manager: fix refcount leak in is_full_charged() - ntfs3: fix out-of-bounds read in decompress_lznt - ntfs3: validate split-point offset in indx_insert_into_buffer - ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head - ntfs3: cap RESTART_TABLE free-chain walker at rt->used - fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} - fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow - fs/ntfs3: validate lcns_follow in log_replay conversion - fs/ntfs3: bound attr_off in UpdateResidentValue against data_off - fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass - fs/ntfs3: bound DeleteIndexEntryAllocation memmove length - fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename - mm/damon/core: make charge_addr_from aware of end-address exclusivity - power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak - MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() - MIPS: ip22-gio: fix device reference leak in probe - MIPS: ip22-gio: fix kfree() of static object - MIPS: ip22-gio: fix gio device memory leak - remoteproc: qcom: Fix leak when custom dump_segments addition fails - SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing - lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure - lockd: Plug nlm_file leak when nlm_do_fopen() fails - sunrpc: wait for in-flight TLS handshake callback when cancel loses race - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback - nvdimm/btt: Free arena sub-allocations on discover_arenas() error path - nvdimm/btt: Free arenas on btt_init() error paths - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() - Bluetooth: SCO: hold sk properly in sco_conn_ready - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - HID: playstation: validate num_touch_reports in DualShock 4 reports - mfd: tps6586x: Fix OF node refcount - cifs: invalidate cfid on unlink/rename/rmdir - batman-adv: tt: prevent TVLV OOB check overflow - batman-adv: frag: fix primary_if leak on failed linearization - batman-adv: frag: free unfragmentable packet - batman-adv: fix VLAN priority offset - batman-adv: tt: avoid request storms during pending request - batman-adv: dat: fix tie-break for candidate selection - batman-adv: dat: ensure accessible eth_hdr proto field - batman-adv: bla: reacquire gw address after skb realloc - batman-adv: dat: acquire ARP hw source only after skb realloc - batman-adv: access unicast_ttvn skb->data only after skb realloc - batman-adv: gw: acquire ethernet header only after skb realloc - s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() - perf/x86/amd/lbr: Fix kernel address leakage - x86/boot: Reject too long acpi_rsdp= values - x86/boot: Validate console=uart8250 baud rate to fix early boot hang - tools/power/x86/intel-speed-select: Harden daemon pidfile open - mfd: sm501: Fix reference leak on failed device registration - leds: uleds: Fix potential buffer overread - selinux: fix incorrect execmem checks on overlayfs - selinux: check connect-related permissions on TCP Fast Open - soc: fsl: qe: panic on ioremap() failure in qe_reset() - soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy - gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() - netfilter: xt_nat: reject unsupported target families - netfilter: ecache: fix inverted time_after() check - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag - netfilter: nf_nat_sip: reload possible stale data pointer - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst - netfilter: xt_cluster: reject template conntracks in hash match - netfilter: nfnl_cthelper: apply per-class values when updating policies - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read - ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback - ASoC: mediatek: mt8183: Release reserved memory on cleanup - ASoC: mediatek: mt8192: Release reserved memory on cleanup - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get - fbdev: tridentfb: fix potential memory leak in trident_pci_probe() - fbdev: nvidia: fix potential memory leak in nvidiafb_probe() - fbdev: vesafb: fix memory leak in vesafb_probe() - fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() - fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() - fbdev: uvesafb: fix potential memory leak in uvesafb_probe() - fbdev: s3fb: fix potential memory leak in s3_pci_probe() - fbdev: i740fb: fix potential memory leak in i740fb_probe() - fbdev: radeon: fix potential memory leak in radeonfb_pci_register() - fbdev: sm712: Fix operator precedence in big_swap macro - fbdev: hecubafb: fix potential memory leak in hecubafb_probe() - fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() - fbdev: metronomefb: fix potential memory leak in metronomefb_probe() - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs - KVM: s390: pci: Fix handling of AIF enable without AISB - KVM: arm64: vgic: Check the interrupt is still ours before migrating it - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure - arm64: dts: qcom: sdm630: describe adsp_mem region properly - arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() - net: ife: require ETH_HLEN to be pullable in ife_decode() - net: atm: reject out-of-range traffic classes in QoS validation - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() - ASoC: SOF: topology: validate vendor array size before parsing - ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get - ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc - ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put - vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter - mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() - smb: client: fix overflow in passthrough ioctl bounds check - octeontx2-af: fix VF bringup affecting PF promiscuous state - net/mlx5: Fix L3 tunnel entropy refcount leak - selftests/net: fix EVP_MD_CTX leak in tcp_mmap - regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK - dm era: fix NULL pointer dereference in metadata_open() - SUNRPC: pin upper rpc_clnt across the TLS connect_worker - SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED - cifs: validate DFS referral string offsets - s390/zcrypt: Remove the empty file - ipvs: ensure inner headers in ICMP errors are in headroom - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors - ipvs: use parsed transport offset in TCP state lookup - ipvs: pass parsed transport offset to state handlers - ipv6: mcast: Fix potential UAF in MLD delayed work - ipv6: mcast: Replace locking comments with lockdep annotations. - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() - octeontx2-pf: check DMAC extraction support before filtering - net/sched: cake: reject overhead values that underflow length - net: usb: lan78xx: disable VLAN filter in promiscuous mode - net: usb: lan78xx: move functions to avoid forward definitions - net/tls: Consume empty data records in tls_sw_read_sock() - ring-buffer: Fix event length with forced 8-byte alignment - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() - Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length - Bluetooth: MGMT: Fix adv monitor add failure cleanup - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control - amt: fix size calculation in amt_get_size() - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket - net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload - net: qualcomm: rmnet: validate MAP frame length before ingress parsing - qede: fix off-by-one in BD ring consumption on build_skb failure - net: microchip: vcap: fix races on the shared Super VCAP block - net/mlx5e: Fix HV VHCA stats agent registration race - net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation - netfilter: xt_connmark: reject invalid shift parameters - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop - netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() - netfilter: xt_u32: reject invalid shift counts - gue: validate REMCSUM private option length - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup - selftests/hid: Cover hid_bpf_get_data() size overflow - selftests/hid: convert the hid_bpf selftests with struct_ops - selftests/hid: force using our compiled libbpf headers - selftests/hid: do not manually call headers_install - selftests/hid: ensure we can compile the tests on kernels pre-6.3 - HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() - ata: sata_gemini: unwind clocks on IDE pinctrl errors - minix: avoid overflow in bitmap block count calculation - afs: Fix unchecked-length string display in debug statement - afs: Fix the volume AFS_VOLUME_RM_TREE is set on - afs: Fix vllist leak - afs: Fix callback service message parsers to pass through -EAGAIN - afs: use kvfree() to free memory allocated by kvcalloc() - afs: Fix error code in afs_extract_vl_addrs() - fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid - net/sched: hhf: clear heavy-hitter state on reset - pinctrl: meson: restore non-sleeping GPIO access - gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe - ksmbd: fix use-after-free of fp->owner.name in durable handle owner check - smb: move some duplicate definitions to common/cifsglob.h - net/sched: act_bpf: use rcu_dereference_bh() to read the filter - cxgb4: Fix decode strings dump for T6 adapters - virtio_net: disable cb when NAPI is busy-polled - irqchip/ts4800: Fix missing chained handler cleanup on remove - irqchip/gic-v3-its: Fix OF node reference leak - tracing: eprobe: read the complete FILTER_PTR_STRING pointer - tracing/events: Fix to check the simple_tsk_fn creation - bridge: stp: Fix a potential use-after-free when deleting a bridge - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF - net: gianfar: dispose irq mappings on probe failure and device removal - net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() - hwmon: (pmbus) Fix passing events to regulator core - hwmon: adm1275: Prevent reading uninitialized stack - MIPS: DEC: Ensure RTC platform device deregistration upon failure - sctp: fix SCTP_RESET_STREAMS stream list length limit - net: enetc: check the number of BDs needed for xdp_frame - qede: fix out-of-bounds check for cqe->len_list[] - seg6: validate SRH length before reading fixed fields - gpio: htc-egpio: use managed gpiochip registration - gpio: mvebu: fail probe if gpiochip registration fails - spi: sh-msiof: abort transfers when reset times out - tracing: probes: fix typo in a log message - dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback - ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count - net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove - net: sungem: fix probe error cleanup - net: mvneta: re-enable percpu interrupt on resume - rtc: cmos: unregister HPET IRQ handler on probe failure - rtc: ds1307: Fix off-by-one issue with wday for rx8130 - smb/client: preserve errors from smb2_set_sparse() - ipv6: fix error handling in disable_policy sysctl - ipv6: fix error handling in forwarding sysctl - ipv6: fix error handling in ignore_routes_with_linkdown sysctl - ipv6: fix error handling in disable_ipv6 sysctl - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - veth: fix NAPI leak in XDP enable error path - net: dsa: sja1105: round up PTP perout pin duration - net, bpf: check master for NULL in xdp_master_redirect() - alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs - alpha/PCI: Add security_locked_down() check to pci_mmap_resource() - NTB: epf: Fix doorbell bitmask and IRQ vector handling - NTB: epf: Report 0-based doorbell vector via ntb_db_event() - NTB: epf: Make db_valid_mask cover only real doorbell bits - netfilter: nft_compat: ebtables emulation must reject non-bridge targets - netfilter: nft_synproxy: stop bypassing the priv->info snapshot - netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() - ipv4: fib: Don't ignore error route in local/main tables. - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). - ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE - rtc: msc313: fix NULL deref in shared IRQ handler at probe - i40e: Fix i40e_debug() to use struct i40e_hw argument - ice: fix AQ error code comparison in ice_set_pauseparam() - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() - PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 - PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 - bpf: zero-initialize the fib lookup flow struct - bpf: Fix stack slot index in nospec checks - rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 - rtc: abx80x: fix the RTC_VL_CLR clearing all status flags - octeontx2-pf: mcs: Fix mcs resources free on PF shutdown - octeontx2-pf: Clear stats of all resources when freeing resources - octeontx2-af: mcs: Fix unsupported secy stats read - net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() - net: marvell: prestera: initialize err in prestera_port_sfp_bind - selftests/mm: fix exclusive_cow test fork() handling - selftests/mm: allow PUD-level entries in compound testcase of hmm tests - selftests/mm: clarify alternate unmapping in compaction_test - irqchip/crossbar: Fix parent domain resource leak - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak - netfilter: nf_reject: skip iphdr options when looking for icmp header - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types - netfilter: ipset: annotate "pos" for concurrent readers/writers - netfilter: ipset: Fix data race between add and dump in all hash types - md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry - ieee802154: fix kernel-infoleak in dgram_recvmsg() - ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() - ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() - ACPI: resource: Amend kernel-doc style - thermal: intel: Fix dangling resources on thermal_throttle_online() failure - arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints - flow_dissector: check device type before reading ETH_ADDRS - devlink: Fix parent ref leak in devl_rate_node_create() - dpaa2-switch: fix VLAN upper check not rejecting bridge join - virtio-net: fix len check in receive_big() - spi: rpc-if: Use correct device for hardware reinitialization on resume - PCI: iproc: Restore .map_irq() for the platform bus driver - sctp: hold socket lock when dumping endpoints in sctp_diag - net: psample: fix info leak in PSAMPLE_ATTR_DATA - octeontx2-pf: Fix leak of SQ timestamp buffer on teardown - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free - ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode - xfrm: validate selector family and prefixlen during match - xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] - xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path - xfrm: Use the XFRM_GRO to indicate a GRO call on input - spi: dw: fix wrong BAUDR setting after resume - gpio: mlxbf3: fail probe if gpiochip registration fails - sparc: led: avoid trimming a newline from empty writes - apparmor: fix label can not be immediately before a declaration - i3c: master: Prevent reuse of dynamic address on device add failure - apparmor: put secmark label after secid lookup - apparmor: aa_getprocattr free procattr leak on format failure - apparmor: fix potential UAF in aa_replace_profiles - apparmor: grab ns lock and refresh when looking up changehat child profiles - apparmor: fix rawdata_f_data implicit flex array - apparmor: aa_label_alloc use aa_label_free on alloc failure - apparmor: check label build before no_new_privs test - security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() - Revert "PCI/MSI: Unmap MSI-X region on error" - PCI: mediatek: Use actual physical address instead of virt_to_phys() - PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() - tools lib api: Fix mount_overload() snprintf truncation and toupper range - tools lib api: Fix filename__write_int() writing uninitialized stack data - tools lib api: Fix missing null termination in filename__read_int/ull() - xprtrdma: Return sendctx slot after Send preparation failure - xprtrdma: Repost Receive buffers for malformed replies - xprtrdma: Sanitize the reply credit grant after parsing - xprtrdma: Fix bcall rep leak and unbounded peek - xprtrdma: Resize reply buffers before reposting receives - xprtrdma: Document and assert reply-handler invariants - xprtrdma: Check frwr_wp_create() during connect - PCI: rcar-host: Remove unused LIST_HEAD(res) - fs/ntfs3: resize log->one_page_buf when adopting on-disk page size - PCI: meson: Propagate devm_add_action_or_reset() failure - PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write - NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors - nfs: keep PG_UPTODATE clear after read errors in page groups - NFSv4/pnfs: defer return_range callbacks until after inode unlock - xprtrdma: Decouple req recycling from RPC completion - xprtrdma: Use sendctx DMA state for Send signaling - xprtrdma: Post receive buffers after RPC completion - xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot - xprtrdma: Avoid 250 ms delay on backlog wakeup - xprtrdma: Remove temp allocation of rpcrdma_rep objects - pNFS/filelayout: fix cheking if a layout is striped - clk: qcom: a53: Corrected frequency multiplier for 1152MHz - dmaengine: Fix possible use after free - dmaengine: qcom: gpi: set DMA_PRIVATE capability - perf: Fix off-by-one stack buffer overflow in kallsyms__parse() - dmaengine: imx-sdma: Refine spba bus searching in probe - drm/amd/display: Add missing kdoc for ALLM parameters - fs/ntfs3: fix mount failure on 64K page-size kernels - fs/ntfs3: add bounds check to run_get_highest_vcn() - HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter - clk: at91: keep securam node alive while mapping it - iio: tcs3472: power down chip on probe failure - iio: accel: mma8452: handle I2C read error(s) in mma8452_read() - iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling - iio: magnetometer: ak8975: fix potential kernel stack memory leak - iio: light: si1133: prevent race condition on timeout - iio: light: si1133: reset counter to prevent race condition - char: tlclk: fix use-after-free in tlclk_cleanup() - usb: host: max3421: Reject hub port requests for non-existent ports - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() - staging: most: video: avoid double free on video register failure - mailbox: mtk-adsp: fix UAF during device teardown - phy: phy-can-transceiver: Check driver match and driver data against NULL - bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() - platform/x86: xo15-ebook: Fix wakeup source and GPE handling - x86/platform/olpc: xo15: Drop wakeup source on driver removal - PCI/ASPM: Don't reconfigure ASPM entering low-power state - coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore - coresight: cti: Fix DT filter signals silently ignored - staging: nvec: fix use-after-free in nvec_rx_completed() - net/9p: fix race condition on rdma->state in trans_rdma.c - ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write - mfd: cs42l43: Sanity check firmware size - ksmbd: fix use-after-free in same_client_has_lease() - ionic: Fix check in ionic_get_link_ext_stats - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) - tipc: fix UAF in tipc_l2_send_msg() - KEYS: Use acquire when reading state in keyring search - powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus - powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down - MIPS: mm: Fix out-of-bounds write in maar_res_walk() - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() - bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket - selftests/bpf: Initialize operation name before use - smb/client: always return a value for FS_IOC_GETFLAGS - cifs: remove all cifs files before kill super - ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() - netfilter: nf_conncount: callers must hold rcu read lock - kcm: use WRITE_ONCE() when changing lower socket callbacks - net: bcmgenet: Use weighted round-robin TX DMA arbitration - net: wwan: t7xx: check skb_clone in control TX - net/mlx5: Check max_macs devlink param value against max capability - bpf: Run generic devmap egress prog on private skb - net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check - net: mana: initialize gdma queue id to INVALID_QUEUE_ID - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen - handshake: Require admin permission for DONE command - power: supply: core: fix supplied_from allocations - ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO - spi: xilinx: use FIFO occupancy register to determine buffer size - crypto: rng - Free default RNG on module exit - crypto: cavium/cpt - fix DMA cleanup using wrong loop index - crypto: marvell/octeontx - fix DMA cleanup using wrong loop index - cxl/test: Add check after kzalloc() memory in alloc_mock_res() - tipc: reject inverted service ranges from peer bindings - tipc: prevent snt_unacked underflow on CONN_ACK - tipc: require net admin for TIPCv2 netlink mutators - net/sched: sch_hfsc: Don't make class passive twice - sctp: validate embedded address parameter length - bridge: cfm: reject invalid CCM interval at configuration time - net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). - net/sched: cls_flow: Dont expose folded kernel pointers - ASoC: tegra: tegra210_ahub: Validate written enum value - ASoC: fsl: fsl_audmix: Validate written enum values - ASoC: codecs: hdac_hdmi: Validate written enum value - RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one - RDMA/mlx5: Fix undefined shift of user RQ WQE size - RDMA/mlx5: Remove raw RSS QP restrack tracking - fs: efs: remove unneeded debug prints - Bluetooth: vhci: validate devcoredump state before side effects - Bluetooth: hci: validate codec capability element length - Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device - s390/process: Fix kernel thread function pointer type - bpf: Tighten cgroup storage cookie checks for prog arrays - of: cpu: add check in __of_find_n_match_cpu_property() - cxl/test: Zero out LSA backing memory to avoid leaking to user - cxl/test: Fix integer overflow in mock LSA bounds checks - selftests/bpf: Fix bpf_iter/task_vma test - ext4: fix kernel BUG in ext4_write_inline_data_end - bonding: 3ad: fix mux port state on oper down - ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails - tools/virtio: check mmap return value in vringh_test - vhost/net: complete zerocopy ubufs only once - vduse: Requeue failed read to send_list head - vhost/vdpa: validate virtqueue index in mmap and fault paths - vduse: hold vduse_lock across IDR lookup in open path - ASoC: codecs: aw88261: fix incorrect masks for boost regs - spi: meson-spifc: fix runtime PM leak on remove - IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified - btrfs: zoned: don't account data relocation space-info in statfs free space - hwmon: (it87) Clamp negative values to zero in set_fan() - fbdev: sm501fb: Fix buffer errors in OF binding code - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() - wifi: mt76: mt7921: fix potential tx_retries underflow - wifi: mt76: mt7915: fix potential tx_retries underflow - wifi: mt76: fix argument to ieee80211_is_first_frag() - hwspinlock: qcom: avoid uninitialized struct members - vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() - pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 - pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 - scsi: target: Remove tcm_loop target reset handling - watchdog: unregister PM notifier on watchdog unregister - configfs: fix lockless traversals of ->s_children - firmware_loader: Fix recursive lock in device_cache_fw_images() - spi: ep93xx: fix double-free of zeropage on DMA setup failure - IB/mlx5: Properly support implicit ODP rereg_mr - IB/mlx5: Don't take the rereg_mr fallback without a new translation - ACPI: IPMI: Fix message kref handling on dead device - ALSA: seq: Clear variable event pointer on read - riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe - ALSA: seq: Fix partial userptr event expansion - wifi: wcn36xx: fix OOB read from short trigger BA firmware response - wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response - bpf: Update transport_header when encapsulating UDP tunnel in lwt - arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well - RDMA/irdma: Initialize iwmr->access during MR registration - RDMA/irdma: Fix OOB read during CQ MR registration - IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() - netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures - ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() - ocfs2/dlm: require a ref for locking_state debugfs open - ocfs2: reject FITRIM ranges shorter than a cluster - ocfs2: fix buffer head management in ocfs2_read_blocks() - ocfs2: rebase copied fsdlm LVB pointers in locking_state - perf/x86/amd/core: Always use the NMI latency mitigation - bpftool: Use libbpf error code for flow dissector query - drm/amdgpu: set sub_block_index for mca ras sub-blocks - configfs_lookup(): don't leave ->s_dentry dangling on failure - lib/test_meminit: use && for bools - sched: restore timer_slack_ns when resetting RT policy on fork - ext2: fix ignored return value of generic_write_sync() - mm/fake-numa: fix under-allocation detection in uniform split - scsi: ufs: Fix wrong value printed in unexpected UPIU response case - scsi: pm8001: Fix error code in non_fatal_log_show() - scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" - nvdimm/btt: Handle preemption in BTT lane acquisition - ARM: imx31: Fix IIM mapping leak in revision check - ata: libata: Fix ata_exec_internal() - HID: wiimote: Fix table layout and whitespace errors - ARM: imx3: Fix CCM node reference leak - ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble - ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback - md/raid10: reset read_slot when reusing r10bio for discard - rpmsg: use generic driver_override infrastructure - media: qcom: venus: relax encoder frame/blur step size on v6 - media: qcom: venus: relax encoder frame/blur dimension steps on v4 - media: qcom: venus: drop extra padding in NV12 raw size calculation - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe - EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info - drm/msm/dp: Fix the ISR_* enum values - drm/msm/dp: fix HPD state status bit shift value - ocfs2: kill osb->system_file_mutex lock - ocfs2: don't BUG_ON an invalid journal dinode - rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() - dax/kmem: account for partial discontiguous resource upon removal - libbpf: Fix UAF in strset__add_str() - libbpf: Harden parse_vma_segs() path parsing - drm/nouveau/bios: specify correct display fuse register for Ampere and Ada - drm/tegra: Fix iommu_map_sgtable() return value check - gpu: host1x: Fix iommu_map_sgtable() return value check - drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() - gpu: host1x: Allow entries in BO caches to be freed - drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove - drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered - net/sched: cls_bpf: prevent unbounded recursion in offload rollback - ipv6: guard against possible NULL deref in __in6_dev_stats_get() - workqueue: drop spurious '*' from print_worker_info() fn declaration - nvme-multipath: fix flex array size in struct nvme_ns_head - pinctrl: cs42l43: Fix polarity on debounce - ALSA: seq: midi: Serialize output teardown with event_input - mtd: spi-nor: Drop duplicate Kconfig dependency - mips: n64: add __iomem for writel call - mips: ralink: mt7621: add missing __iomem - MIPS: DEC: Remove do_IRQ() call indirection - MIPS: Fix big-endian stack argument fetching in o32 wrapper - PM: sleep: Use complete() in device_pm_sleep_init() - RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup - IB/mlx4: Fix refcount leak in add_port() error path - RDMA/rxe: Fix a use-after-free problem in rxe_mmap - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs - bus: sunxi-rsb: Always check register address validity - pwm: imx27: Fix variable truncation in .apply() - device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node - firmware: arm_scmi: Fix OOB in scmi_power_name_get() - media: rockchip: rga: fix too small buffer size - net/sched: sch_drr: annotate data-races around cl->deficit - regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions - bitops: use common function parameter names - sysfs: clamp show() return value in sysfs_kf_read() - firmware: arm_scmi: Read sensor config as 32-bit value - media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() - RDMA/srpt: fix integer overflow in immediate data length check - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference - RDMA/hns: Fix arithmetic overflow in calc_hem_config() - IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier - ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD - net/sched: sch_htb: annotate data-races (I) - net/sched: sch_htb: do not change sch->flags in htb_dump() - crypto: ccp - Treat zero-length cert chain as query for blob lengths - net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() - clk: scpi: Unregister child clock providers on remove - thermal: hwmon: Fix critical temperature attribute removal - evm: terminate and bound the evm_xattrs read buffer - drm/hisilicon/hibmc: use clock to look up the PLL value - drm/hisilicon/hibmc: move display contrl config to hibmc_probe() - arm64: dts: qcom: sm8450: Fix ICE reg size - clk: scmi: Fix clock rate rounding - arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host - iommu/amd: Fix a stale comment about which legacy mode is user visible - nilfs2: fix backing_dev_info reference leak - dlm: fix add msg handle in send_queue ordered - crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve - crypto: atmel-sha204a - fix blocking and non-blocking rng logic - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). - arm64: dts: imx8x-colibri: Correct SODIMM PAD settings - arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc - pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path - media: v4l2-common: Add YUV24 format info - media: cedrus: Fix failure to clean up hardware on probe failure - watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure - watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 - watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH - ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint - wifi: ath9k: fix OOB access from firmware tx status queue ID - kconfig: fix potential NULL pointer dereference in conf_askvalue - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer - wifi: rtw89: Correct data type for scan index to avoid infinite loop - driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() - drm/amdkfd: Validate CRIU-restored IDs before idr_alloc - dt-bindings: pinctrl: nvidia,tegra234: Add missing required block - arm64: tegra: Fix Tegra234 MGBE PTP clock - wifi: cfg80211: fix grammar in MLO group key error message - arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning - arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S - Documentation: proc: fix section numbering in table of contents - libbpf: Report error when a negative kprobe offset is specified - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure - drm/radeon: fix integer overflow in radeon_align_pitch() - drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() - drm/tidss: Drop extra drm_mode_config_reset() call - drm/rockchip: Test for imported buffers with drm_gem_is_imported() - clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() - afs: Fix further netns teardown to cancel the preallocation charger - afs: fix NULL pointer dereference in afs_get_tree() - afs: Fix netns teardown to cancel the preallocation charger - rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) - serial: 8250_omap: clear rx_running on zero-length DMA completes - serial: msm: Disable DMA for kernel console UART - dt-bindings: power: imx93: Add MIPI PHY power domain - dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties - media: uvcvideo: Fix sequence number when no EOF - media: uvcvideo: Fix buffer sequence in frame gaps - media: uvcvideo: Avoid partial metadata buffers - crypto: crypto4xx - Remove insecure and unused rng_alg - crypto: crypto4xx - Remove ahash-related code - crypto: sun4i-ss - Remove insecure and unused rng_alg - nvmet-tcp: Fix potential UAF when ddgst mismatch - KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU - crypto: algif_skcipher - force synchronous processing on trees without ctx->state - fuse: re-lock request before returning from fuse_ref_folio() - fuse: fix device node leak in cuse_process_init_reply() - RDMA/siw: bound Read Response placement to the RREAD length - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg - Input: maplecontrol - set driver data before registering input device - Input: maplemouse - set driver data before registering input device - Input: maple_keyb - set driver data before registering input device - Input: mms114 - fix multi-touch slot corruption - Input: maplemouse - fix NULL pointer dereference in open() - Input: mms114 - reject an oversized device packet size - Input: touchwin - reset the packet index on every complete packet - Input: mms114 - fix touch indexing for MMS134S and MMS136 - Input: iforce - bound the device-reported force-feedback effect index - Input: goodix - clamp the device-reported contact count - Input: elan_i2c - prevent division by zero and arithmetic underflow - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count - Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure - i2c: stm32f7: truncate clock period instead of rounding it - i2c: mpc: Fix timeout calculations - udmabuf: fix DMA direction mismatch in release_udmabuf() - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode - KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs - NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() - exfat: bound uniname advance in exfat_find_dir_entry() - module: decompress: check return value of module_extend_max_pages() - watchdog: apple: Add "apple,t8103-wdt" compatible - EDAC/i10nm: Don't fail probing if ADXL is missing - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() - arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() - crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation - crypto: talitos/hash - remove useless wrapper - crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request - crypto: talitos/hash - drop workqueue mechanism for SEC1 - crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue - crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor - crypto: talitos - move code in current_desc_hdr() into a standalone function - crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function - crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function - crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 - crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header - crypto: drbg - Fix the fips_enabled priority boost - crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels - crypto: caam - use print_hex_dump_devel to guard key hex dumps again - crypto: caam - use print_hex_dump_devel to guard key hex dumps - crypto: af_alg - Remove zero-copy support from skcipher and aead - partitions: aix: bound the pp_count scan to the ppe array - btrfs: do not trim a device which is not writeable - nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks - dm-ioctl: report an error if a device has no table - hwrng: jh7110 - fix refcount leak in starfive_trng_read() - iio: temperature: ltc2983: Fix n_wires default bypassing rotation check - usb: typec: ucsi: cancel pending work on system suspend - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove - usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode - usb: typec: ucsi: Invert DisplayPort role assignment - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() - usb: typec: class: drop PD lookup reference - usb: typec: anx7411: use devm_pm_runtime_enable() - usbip: vudc: fix NULL deref in vep_dequeue() - usbip: tools: support SuperSpeedPlus devices - USB: usb-storage: ene_ub6250: restore media-ready check - USB: ulpi: fix memory leak on registration failure - USB: serial: digi_acceleport: fix write buffer corruption - USB: serial: digi_acceleport: fix hard lockup on disconnect - USB: serial: digi_acceleport: fix broken rx after throttle - USB: serial: option: add Telit Cinterion FE990D50 compositions - USB: serial: keyspan_pda: fix information leak - usb: mtu3: unmap request DMA on queue failure - USB: misc: uss720: unregister parport on probe failure - USB: storage: include US_FL_NO_SAME in quirks mask - usb: sl811-hcd: disable controller wakeup on remove - USB: legousbtower: fix use-after-free on disconnect race - USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD - USB: ldusb: fix use-after-free on disconnect race - USB: idmouse: fix use-after-free on disconnect race - usb: gadget: f_printer: take kref only for successful open - usb: gadget: udc: Fix use-after-free in gadget_match_driver - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler - usb: free iso schedules on failed submit - usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() - USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub - usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() - usb: cdc_acm: Add quirk for Uniden BC125AT scanner - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() - bpf: Restore sysctl new-value from 1 to 0 - xfs: fix unreachable BIGTIME check in dquot flush validation - xfs: use null daddr for unset first bad log block - media: mtk-jpeg: cancel workqueue on release for supported platforms only - nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers - hfs/hfsplus: zero-initialize buffer in hfs_bnode_read - HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads - HID: letsketch: fix UAF on inrange_timer at driver unbind - HID: wacom: stop hardware after post-start probe failures - tools/mm/slabinfo: fix total_objects attribute name - tools/mm/slabinfo: Fix trace disable logic inversion - X.509: Fix validation of ASN.1 certificate header - clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation - cpufreq: Fix hotplug-suspend race during reboot - cpufreq: intel_pstate: Sync policy->cur during CPU offline - firmware_loader: fix device reference leak in firmware_upload_register() - OPP: of: Fix potential memory leak in opp_parse_supplies() - smb: client: use unaligned reads in parse_posix_ctxt() - smb: client: fix query directory replay double-free - ksmbd: use opener credentials for delete-on-close - ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION - ksmbd: run set info with opener credentials - ksmbd: require source read access for duplicate extents - ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation - ksmbd: serialize QUERY_DIRECTORY requests per file - ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE - smb/client: Fix error code in smb2_aead_req_alloc() - coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() - fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() - fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() - fs/ntfs3: handle attr_set_size() errors when truncating files - fs/ntfs3: fsync files by syncing parent inodes - Bluetooth: L2CAP: validate option length before reading conf opt value - Bluetooth: fix UAF in bt_accept_dequeue() - Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() - Bluetooth: bnep: pin L2CAP connection during netdev registration - Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() - netfilter: ebtables: terminate table name before find_table_lock() - netfilter: ebtables: module names must be null-terminated - mm: shrinker: fix NULL pointer dereference in debugfs - mfd: cros_ec: Delay dev_set_drvdata() until probe success - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes - ipv4: igmp: remove multicast group from hash table on device destruction - gpio: eic-sprd: use raw_spinlock_t in the irq startup path - NTB: epf: Avoid calling pci_irq_vector() from hardirq context - fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns - debugobjects: Plug race against a concurrent OOM disable - Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete - audit: Fix data races of skb_queue_len() readers on audit_queue - net: af_key: initialize alg_key_len for IPComp states - crypto: amlogic - avoid double cleanup in meson_crypto_probe() - staging: rtl8723bs: fix OOB write in HT_caps_handler() - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() - staging: media: atomisp: reduce load_primary_binaries() stack usage - media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe - staging: vme_user: fix location monitor leak in tsi148 bridge - staging: vme_user: fix location monitor leak in fake bridge - staging: vme_user: bound slave read/write to the kern_buf size - tipc: fix out-of-bounds read in broadcast Gap ACK blocks - 6lowpan: fix NHC entry use-after-free on error path - usb: dwc3: run gadget disconnect from sleepable suspend context - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() - virtio-mmio: fix device release warning on module unload - netfilter: ipset: fix race between dump and ip_set_list resize - mm/damon/ops-common: handle extreme intervals in damon_hot_score() - PCI: host-common: Request bus reassignment when not probe-only - PCI: altera: Do not dispose parent IRQ mapping - usb: typec: tcpci_rt1711h: unregister TCPCI port with devres - usb: xhci: Fix sleep in atomic context in xhci_free_streams() - binder: fix UAF in binder_free_transaction() - binder: fix UAF in binder_thread_release() - Bluetooth: btusb: fix wakeup source leak on probe failure - Bluetooth: btusb: fix use-after-free on marvell probe failure - Bluetooth: btusb: fix use-after-free on registration failure - Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB - vfio/pci: Release the VGA arbiter client on register_device() failure - ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes - ALSA: usb-audio: Update Babyface Pro control caches only after successful writes - ALSA: usb-audio: Roll back quirk control caches on write errors - ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks - ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() - ALSA: usb-audio: avoid kobject path lookup in DualSense match - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() - ALSA: ice1712: check snd_ctl_new1() return value - ALSA: gus: check snd_ctl_new1() return value - ALSA: firewire: isight: bound the sample count to the packet payload - ALSA: es1938: check snd_ctl_new1() return value - ALSA: cmipci: check snd_ctl_new1() return value - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser - ALSA: ymfpci: check snd_ctl_new1() return value - ALSA: virtio: Add missing 384 kHz PCM rate mapping - iio: temperature: ltc2983: Fix reinit_completion() called after conversion start - iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call - iio: light: veml6030: fix channel type when pushing events - iio: light: tsl2591: return actual error from probe IRQ failure - iio: light: opt3001: fix missing state reset on timeout - iio: light: gp2ap002: fix runtime PM leak on read error - iio: light: al3010: fix incorrect scale for the highest gain range - iio: imu: st_lsm6dsx: deselect shub page before reading whoami - iio: imu: inv_icm42600: fix timestamp clock period by using lower value - iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ - iio: gyro: bmg160: wait full startup time after mode change at probe - iio: gyro: bmg160: bail out when bandwidth/filter is not in table - iio: chemical: scd30: Cleanup initializations and fix sign-extension bug - iio: adc: ti-ads124s08: Return reset GPIO lookup errors - iio: adc: spear: Initialize completion before requesting IRQ - iio: adc: lpc32xx: Initialize completion before requesting IRQ - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error - iio: accel: bmc150: clamp the device-reported FIFO frame count - usb: gadget: function: rndis: add length check for header - usb: gadget: function: rndis: add length check to response query - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - stop using crypto_ahash::init - Revert "crypto: talitos - fix SEC1 32k ahash request limitation" - Revert "crypto: talitos - rename first/last to first_desc/last_desc" - ACPI: NFIT: core: Fix possible NULL pointer dereference - ACPI: CPPC: Suppress UBSAN warning caused by field misuse - perf trace beauty fcntl: Fix build with older kernel headers - Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID - xfs: move ->iop_recover to xfs_defer_op_type - xfs: use xfs_defer_finish_one to finish recovered work items - xfs: dump the recovered xattri log item if corruption happens - xfs: recreate work items when recovering intent items - net: add a common function to compute features for upper devices - bonding: Correctly support GSO ESP offload - bonding: add ESP offload features when slaves support - bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features - net, team, bonding: Add netdev_base_features helper - net: team: rename team to team_core for linking - nfsd: change nfs4_client_to_reclaim() to allocate data - nfsd: move name lookup out of nfsd4_list_rec_dir() - apparmor: advertise the tcp fast open fix is applied - nfsd: Don't reset the write verifier on a commit EAGAIN - NFSv4/flexfiles: reject zero filehandle version count - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() - i2c: core: fix irq domain leak on adapter registration failure - block: Avoid mounting the bdev pseudo-filesystem in userspace - f2fs: fix listxattr handling of corrupted xattr entries - f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() - f2fs: fix potential deadlock in f2fs_balance_fs() - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes - f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - f2fs: validate orphan inode entry count - device property: initialize the remaining fields of fwnode_handle in fwnode_init() - drm/amd: Fix set but not used warnings - slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - slimbus: Convert to platform remove callback returning void - slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - slimbus: qcom-ngd-ctrl: Fix probe error path ordering - userfaultfd: gate must_wait writability check on pte_present() - Bluetooth: btusb: mediatek: return error for failed reg access - Bluetooth: btusb: mediatek: remove the unnecessary goto tag - Bluetooth: btusb: mediatek: add MT7922 subsystem reset - Bluetooth: btusb: mediatek: reset the controller before downloading the fw - Bluetooth: btmtk: apply the common btmtk_fw_get_filename - nfsd: reset write verifier on deferred writeback errors - nfsd: release layout stid on setlease failure - bpf, arm64: Reject out-of-range B.cond targets - ia64: Make acpi_cpufreq_cpu_exit return void - netfilter: bridge: eb_tables: close module init race - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents - netfilter: ebtables: move to two-stage removal scheme - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path - crypto: qat - protect service table iterations with service_lock - Bluetooth: eir: Fix stack OOB write when prepending the Flags AD - drm/edid: fix OOB read in drm_parse_tiled_block() - proc: protect ptrace_may_access() with exec_update_lock (FD links) - vfio/pci: Latch disable_idle_d3 per device - bpf: Fix UAF in sock clone early bailouts - bpf: Disable xfrm_decode_session hook attachment - bpf,fork: wipe ->bpf_storage before bailouts that access it - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - crypto: qat - validate RSA CRT component lengths - bpf: Clear rb node linkage when freeing bpf_rb_root - bpf: Add validation for bpf_set_retval argument - bpf: Reject sleepable BPF_LSM_CGROUP programs at load time - bpf: Fix setting retval to -EPERM for cgroup hooks not returning errno - bpf: Guard __get_user acesss with access_ok for uprobe_multi data - i2c: core: fix adapter registration race - ALSA: hda/cs35l41: Fix firmware load work teardown - vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc - iommufd: Break the loop on failure in iommufd_fault_fops_read() - posix-cpu-timers: Prevent UAF caused by non-leader exec() race - iio: event: Fix event FIFO reset race - hwrng: virtio: clamp device-reported used.len at copy_data() - crypto: drbg - Fix returning success on failure in CTR_DRBG - crypto: ecc - Fix carry overflow in vli multiplication - crypto: pcrypt - restore callback for non-parallel fallback - net: openvswitch: reject oversized nested action attrs - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page - e1000e: Fix out-of-bounds MMIO access by validating BAR0 size - bpf: Support for hardening against JIT spraying - xsched: enforce permissions on attribute access - xsched: restrict vstream management to privileged users - rme: use DMA API for virtio in realm world - udf: validate sparing table length as an entry count, not a byte count - smb: client: harden POSIX SID length parsing - smb: client: mask server-provided mode to 07777 in modefromsid - smb: client: Fix next buffer leak in receive_encrypted_standard() - nvmet-auth: validate reply message payload bounds against transfer length - bpf: Reject fragmented frames in devmap - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized - mm/huge_memory: update file PMD counter before folio_put() - smb: client: reject overlapping data areas in SMB2 responses - smb: client: restrict implied bcc[0] exemption to responses without data area - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item - writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() - writeback: Fix use after free in inode_switch_wbs_work_fn() - writeback: Avoid contention on wb->list_lock when switching inodes - block: skip sync_blockdev() on surprise removal in bdev_mark_dead() - mm: do file ownership checks with the proper mount idmap - tracing: Bound synthetic-field strings with seq_buf - perf/core: Detach event groups during remove_on_exec - bpf: Allow LPM map access from sleepable BPF programs - bpf: Consistently use bpf_rcu_lock_held() everywhere - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC - udf: validate VAT header length against the VAT inode size - isofs: bound Rock Ridge symlink components to the SL record - udf: validate free block extents against the partition length - config: arm64: update CONFIG_FTRACE_STARTUP_TEST not set - crypto: qat - Return pointer directly in adf_ctl_alloc_resources - crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - drivers/base/memory: set mem->altmap after successful device registration - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - NFS: Prevent resource leak in nfs_alloc_server() - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - nfsd: check get_user() return when reading princhashlen - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - 9p: avoid putting oldfid in p9_client_walk() error path - ocfs2: reject oversized group bitmap descriptors - rpmsg: char: Fix use-after-free on probe error path - fpga: region: fix use-after-free in child_regions_with_firmware() - irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove - pNFS: Fix use-after-free in pnfs_update_layout() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - hdlc_ppp: sync per-proto timers before freeing hdlc state - gfs2: fix use-after-free in gfs2_qd_dealloc - exfat: fix potential use-after-free in exfat_find_dir_entry() - bpf: use kvfree() for replaced sysctl write buffer - f2fs: keep atomic write retry from zeroing original data - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate compress cache inode only when enabled - wifi: iwlwifi: mvm: fix race condition in PTP removal - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: ath11k: fix warning when unbinding - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - keys: Pin request_key_auth payload in instantiate paths - KEYS: fix overflow in keyctl_pkey_params_get_2() - err.h: use __always_inline on all error pointer helpers - fbdev: fix use-after-free in store_modes() - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - apparmor: mediate the implicit connect of TCP fast open sendmsg - net: skmsg: preserve sg.copy across SG transforms - mac802154: llsec: add skb_cow_data() before in-place crypto - af_unix: Set gc_in_progress to true in unix_gc(). - ntfs3: reject direct userspace writes to reserved $LX* xattrs - ipv4: account for fraggap on the paged allocation path - inet: add indirect call wrapper for getfrag() calls - ipv6: account for fraggap on the paged allocation path - batman-adv: tvlv: avoid race of cifsnotfound handler state - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tt: track roam count per VID - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tp_meter: handle overlapping packets - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: frag: avoid underflow of TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: prevent ELP transmission interval underflow - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: keep unacked list in ascending ordered - eventpoll: rename ep_remove_safe() back to ep_remove() - file: add fput() cleanup helper - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - ksmbd: reject non-VALID session in compound request branch - scripts/sorttable: Fix endianness handling in build-time mcount sort - scripts/sorttable: Allow matches to functions before function entry - scripts/sorttable: Use normal sort if theres no relocs in the mcount section - ftrace: Check against is_kernel_text() instead of kaslr_offset() - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Do not over-allocate ftrace memory - ftrace: Have ftrace pages output reflect freed pages - ftrace: Update the mcount_loc check of skipped entries - scripts/sorttable: Zero out weak functions in mcount_loc table - scripts/sorttable: Always use an array for the mcount_loc sorting - scripts/sorttable: Have mcount rela sort use direct values - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 - scripts/sorttable: Use a structure of function pointers for elf helpers - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly - scripts/sorttable: Move code from sorttable.h into sorttable.c - scripts/sorttable: Use uint64_t for mcount sorting - scripts/sorttable: Add helper functions for Elf_Sym - scripts/sorttable: Add helper functions for Elf_Shdr - scripts/sorttable: Add helper functions for Elf_Ehdr - scripts/sorttable: Convert Elf_Sym MACRO over to a union - scripts/sorttable: Replace Elf_Shdr Macro with a union - scripts/sorttable: Convert Elf_Ehdr to union - scripts/sorttable: Make compare_extable() into two functions - scripts/sorttable: Have the ORC code use the _r() functions to read - scripts/sorttable: Remove unneeded Elf_Rel - scripts/sorttable: Remove unused write functions - scripts/sorttable: Remove unused macro defines - slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - rxrpc: Fix the ACK parser to extract the SACK table for parsing - net: phonet: free phonet_device after RCU grace period - phonet: Pass net and ifindex to phonet_address_notify(). - phonet: Pass ifindex to fill_addr(). - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - regulator: core: fix locking in regulator_resolve_supply() error path - ring-buffer: Remove ring_buffer_read_prepare_sync() - selftests/bpf: Update comments find_equal_scalars->sync_linked_regs - af_unix: Reject SIOCATMARK on non-stream sockets - selftests/bpf: Add test to ensure kprobe_multi is not sleepable - agp/amd64: Fix broken error propagation in agp_amd64_probe() - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() - i2c: stub: Reject I2C block transfers with invalid length - RDMA/bnxt_re: zero shared page before exposing to userspace - KVM: VMX: Update SVI during runtime APICv activation - ARM: fix branch predictor hardening - ARM: fix hash_name() fault - ARM: allow __do_kernel_fault() to report execution of memory faults - ARM: group is_permission_fault() with is_translation_fault() - debugobjects: Dont call fill_pool() in early boot hardirq context - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - batman-adv: tt: prevent TVLV entry number overflow - drm/v3d: Skip CSD when it has zeroed workgroups - drm/v3d: Store the active job inside the queue's state - iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages() - smb: client: fix double-free in SMB2_close() replay - smb: client: fix double-free in SMB2_flush() replay - smb: client: fix query_info() replay double-free - smb: client: fix query directory replay double-free - smb: client: fix double-free in SMB2_open() replay - smb: client: fix double-free in SMB2_ioctl() replay - smb: client: fix change notify replay double-free - HID: lg-g15: cancel pending work on remove to fix a use-after-free - HID: multitouch: fix out-of-bounds bit access on mt_io_flags - tracing: Prevent out-of-bounds read in glob matching - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT - KVM: x86: hyper-v: Bound the bank index when querying sparse banks - MIPS: DEC: Prevent initial console buffer from landing in XKPHYS - ftrace: Add global mutex to serialize trace_parser access - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - RDMA/umem: Fix truncation for block sizes >= 4G - xfs: fail recovery on a committed log item with no regions - fuse: re-lock request before replacing page cache folio - USB: iowarrior: fix use-after-free on disconnect race - usb: iowarrior: remove inherent race with minor number - USB: iowarrior: fix use-after-free on disconnect - apparmor: fix use-after-free in rawdata dedup loop - mm/hugetlb_vmemmap: add vmemmap_split_lock in vmemmap_should_optimize() - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops - rbd: eliminate a race in lock_dwork draining on unmap - blk-cgroup: fix UAF in __blkcg_rstat_flush() - xfs: resample the data fork mapping after cycling ILOCK - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - virtiofs: fix UAF on submount umount - ub:ubus: Modify UBUS review comments - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc - ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL - ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() - time: Fix off-by-one in compat settimeofday() usec validation - scsi: target: Fix hexadecimal CHAP_I handling - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY - ksmbd: add a permission check for FSCTL_SET_ZERO_DATA - ksmbd: add per-handle permission check to FILE_LINK_INFORMATION - mptcp: fix missing wakeups in edge scenarios - mptcp: add-addr: always drop other suboptions - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - RDMA/umem: fix kernel-doc warnings - mm/migrate: don't call folio_putback_active_hugetlb() on dst hugetlb folio - usb: typec: ucsi: Don't update power_supply on power role change if not connected - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - usb: typec: ucsi: Check if power role change actually happened before handling - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - tty: serial: samsung: use u32 for register interactions - serial: samsung_tty: Use port lock wrappers - ALSA: firewire-motu: Protect register DSP event queue positions - memfd: deny writeable mappings when implying SEAL_WRITE - iio: dac: ad5686: fix ref bit initialization for single-channel parts - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - iio: chemical: scd30: fix division by zero in write_raw - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: gyro: adis16260: fix division by zero in write_raw - Bluetooth: hci_qca: Convert timeout from jiffies to ms - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - serdev: Provide a bustype shutdown function - serdev: make serdev_bus_type const - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - mptcp: do not drop partial packets - mptcp: introduce the mptcp_init_skb helper - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: adc: npcm: Convert to platform remove callback returning void - octeontx2-pf: avoid double free of pool->stack on AQ init failure - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - af_unix: Cache state->msg in unix_stream_read_generic(). - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - mptcp: reset rcv wnd on disconnect - mptcp: cleanup fallback dummy mapping generation - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - octeontx2-af: replace deprecated strncpy with strscpy - cgroup/cpuset: Reset DL migration state on can_attach() failure - fbdev/vt8500lcdfb: Initialize fb_ops with fbdev macros - soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - driver core: reject devices with unregistered buses - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/amdkfd: fix NULL dereference in get_queue_ids() - slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - slimbus: qcom-ngd-ctrl: fix OF node refcount - thunderbolt: Limit XDomain response copy to actual frame size - sctp: stream: fully roll back denied add-stream state - mmc: sdhci: add signal voltage switch in sdhci_resume_host - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: core: Fix host controller programming for fixed driver type - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - octeontx2-af: fix memory leak in rvu_setup_hw_resources() - nvmem: layouts: onie-tlv: fix hang on unknown types - net: rds: clear i_sends on setup unwind - net: mv643xx: fix OF node refcount - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - i2c: tegra: Fix NOIRQ suspend/resume - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - pidfd: refuse access to tasks that have started exiting harder - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - vsock/vmci: fix sk_ack_backlog leak on failed handshake - wifi: nl80211: reject oversized EMA RNR lists - selftests: mptcp: add test for extra_subflows underflow on userspace PM - mptcp: sockopt: check timestamping ret value - mptcp: allow subflow rcv wnd to shrink - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: fix retransmission loop when csum is enabled - ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow - ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O - ARM: socfpga: Fix OF node refcount leak in SMP setup - mm/damon/ops-common: call folio_test_lru() after folio_get() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - ALSA: timer: Fix UAF at snd_timer_user_params() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - xfrm: espintcp: do not reuse an in-progress partial send - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - tracing/probes: Point the error offset correctly for eprobe argument error - netfilter: nft_tunnel: fix use-after-free on object destroy - clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - net: mvpp2: refill RX buffers before XDP or skb use - net: mvpp2: Add metadata support for xdp mode - netfilter: nf_log: validate MAC header was set before dumping it - rds: mark snapshot pages dirty in rds_info_getsockopt() - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - r8152: handle the return value of usb_reset_device() - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net: phy: clean the sfp upstream if phy probing fails - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - arm64: tlb: Allow XZR argument to TLBI ops - KVM: arm64: Remove VPIPT I-cache handling - tools/rv: Fix cleanup after failed trace setup - time: Fix off-by-one in settimeofday() usec validation - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - vxlan: vnifilter: fix spurious notification on VNI update - vxlan: vnifilter: send notification on VNI add - octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - ptp: vclock: Switch from RCU to SRCU - net: fec: fix pinctrl default state restore order on resume - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - pcnet32: stop holding device spin lock during napi_complete_done - drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - 6lowpan: fix off-by-one in multicast context address compression - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - tee: optee: prevent use-after-free when the client exits before the supplicant - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - Disable -Wattribute-alias for clang-23 and newer - RDMA/rxe: Fix "trying to register non-static key in rxe_qp_do_cleanup" bug - USB: serial: mct_u232: fix memory corruption with small endpoint - usb: core: Fix SuperSpeed root hub wMaxPacketSize - serial: zs: Convert to use a platform device - serial: dz: Convert to use a platform device - serial: dz: Fix bootconsole handover lockup - xhci: tegra: Fix ghost USB device on dual-role port unplug - USB: serial: digi_acceleport: fix memory corruption with small endpoints - landlock: Fix handling of disconnected directories - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - USB: serial: cypress_m8: fix memory corruption with small endpoint - serial: zs: Switch to using channel reset - serial: zs: Fix bootconsole handover lockup - serial: dz: Fix bootconsole message clobbering at chip reset - drm/amdkfd: Check for pdd drm file first in CRIU restore path - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: sh-sci: fix memory region release in error path - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: altera_jtaguart: handle uart_add_one_port() failures - drm/amd/pm/si: Disregard vblank time when no displays are connected - drm/i915: Fix potential UAF in TTM object purge - drm/hyperv: validate VMBus packet size in receive callback - drm/hyperv: validate resolution_count and fix WIN8 fallback - scsi: target: iscsi: Validate CHAP_R length before base64 decode - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: net2280: Fix double free in probe error path - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: belkin_sa: validate interrupt status length - USB: serial: option: add MeiG SRM813Q - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: storage: Add quirks for PNY Elite Portable SSD - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - usb: chipidea: core: convert ci_role_switch to local variable - tty: serial: pch_uart: add check for dma_alloc_coherent() - counter: Fix refcount leak in counter_alloc() error path - comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: xpad - add support for ASUS ROG RAIKIRI II - Input: xpad - add "Nova 2 Lite" from GameSir - ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - ASoC: qcom: q6asm-dai: close stream only when running - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - xfrm: ah: use skb_to_full_sk in async output callbacks - xfrm: route MIGRATE notifications to caller's netns - nfc: hci: fix out-of-bounds read in HCP header parsing - iommu, debugobjects: avoid gcc-16.1 section mismatch warnings - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - xfrm: input: hold netns during deferred transport reinjection - ipv6: validate extension header length before copying to cmsg - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: exthdrs: refresh nh after handling HAO option - ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - macsec: fix replay protection at XPN lower-PN wrap - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - Input: elan_i2c - validate firmware size before use - usb: dwc2: Fix use after free in debug code - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: cdns3: gadget: fix request skipping after clearing halt - iio: buffer: hw-consumer: fix use-after-free in error path - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: temperature: tsys01: fix broken PROM checksum validation - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: dac: ad5686: acquire lock when doing powerdown control - iio: dac: ad5686: fix input raw value check - iio: dac: max5821: fix return value check in powerdown sync - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - wireguard: send: append trailer after expanding head - KVM: arm64: PMU: Preserve AArch32 counter low bits - parport: Fix race between port and client registration - Input: xpad - fix out-of-bounds access for Share button - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - auxdisplay: line-display: fix OOB read on zero-length message_store() - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - Bluetooth: btusb: Allow firmware re-download when version matches - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - USB: serial: safe_serial: fix memory corruption with small endpoint - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - soc/tegra: pmc: Fix unsafe generic_handle_irq() call - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - drm/dp: Add eDP 1.5 bit definition - drm/i915/psr: Read Intel DPCD workaround register - drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - media: rc: fix race between unregister and urb/irq callbacks - batman-adv: bla: avoid double decrement of bla.num_requests - batman-adv: tt: avoid empty VLAN responses - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tp_meter: avoid role confusion in tp_list - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: tvlv: abort OGM send on tvlv append failure - net: skbuff: fix pskb_carve leaking zcopy pages - ipv6: fix possible infinite loop in fib6_select_path() - ipv6: fix possible infinite loop in rt6_fill_node() - sctp: fix race between sctp_wait_for_connect and peeloff - net: mana: Add NULL guards in teardown path to prevent panic on attach failure - gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - bonding: refuse to enslave CAN devices - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - ASoC: codecs: simple-mux: Fix enum control bounds check - ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - gpio: mxc: fix irq_high handling - net: hsr: fix potential OOB access in supervision frame handling - ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - net/iucv: fix locking in .getsockopt - net/smc: Do not re-initialize smc hashtables - net: netlink: don't set nsid on local notifications - net: netlink: fix sending unassigned nsid after assigned one - vsock: keep poll shutdown state consistent - netfilter: nf_tables: fix dst corruption in same register operation - netfilter: bitwise: add support for doing AND, OR and XOR directly - netfilter: bitwise: rename some boolean operation functions - netfilter: ebtables: fix OOB read in compat_mtw_from_user - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - xfrm: Check for underflow in xfrm_state_mtu - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - nfc: llcp: Fix use-after-free in llcp_sock_release() - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet - drm: Remove plane hsub/vsub alignment requirement for core helpers - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - net: mctp: ensure our nlmsg responses are initialised - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - io_uring: allow io-wq workers to exit when unused - io_uring/io-wq: add exit-on-idle state - mm/slab: Fix a kmemleak in kmem_cache_destroy() - ub: ub_fwctl: Modify the log printing in the code. - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - USB: serial: omninet: fix memory corruption with small endpoint - USB: serial: cypress_m8: validate interrupt packet headers - tls: Flush backlog before waiting for a new record - net: ethernet: cortina: No mapping is a dropped rx - batman-adv: fix batadv_skb_is_frag() kernel-doc - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled - Bluetooth: ISO: fix malformed ISO_END/CONT handling - Bluetooth: MGMT: Fix backward compatibility with userspace - security/keys: fix missed RCU read section on lookup - LoongArch: kprobes: Fix handling of fatal unrecoverable recursions - pds_core: ensure null-termination for firmware version strings - pds_core: add an error code check in pdsc_dl_info_get - net: mana: validate rx_req_idx to prevent out-of-bounds array access - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - string: add mem_is_zero() helper to check if memory area is all zeros - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - net: ag71xx: check error for platform_get_irq - Bluetooth: btmtk: rename btmediatek_data - Bluetooth: btusb: mediatek: refactor the function btusb_mtk_reset - Bluetooth: btmtk: add the function to get the fw name - ALSA: seq: Serialize UMP output teardown with event_input - ALSA: seq: ump: Use guard() for locking - pds_core: fix debugfs_lookup dentry leak and error handling - pds_core: fix error handling in pdsc_devcmd_wait - bridge: mcast: Fix a possible use-after-free when removing a bridge port - net: bridge: Flush multicast groups when snooping is disabled - RDMA/rtrs: Fix use-after-free in path file creation cleanup - platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: dsa: mt7530: rename mt753x_bpdu_port_fw enum to mt753x_to_cpu_fw - net: dsa: mt7530: fix FDB entries not aging out with short timeout - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - drm/msm/snapshot: fix dumping of the unaligned regions - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - net/mlx5: Do not restore destination-less TC rules - tls: Preserve sk_err across recvmsg() when data has been copied - x86/xen: Fix xen_e820_swap_entry_with_ram() - net: phy: DP83TC811: add reading of abilities - net: phy: c45: add genphy_c45_pma_read_ext_abilities() function - net: tls: prevent chain-after-chain in plain text SG - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - drm/msm/dsi: don't dump registers past the mapped region - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - accel/qaic: Add overflow check to remap_pfn_range during mmap - HID: quirks: really enable the intended work around for appledisplay - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath11k: fix error path leaks in some WMI WOW calls - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - net: ethernet: cortina: Carry over frag counter - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Make RX SKB per-port - netfs: Fix overrun check in netfs_extract_user_iter() - zonefs: handle integer overflow in zonefs_fname_to_fno - irqchip/ath79-cpu: Remove unused function - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - net: lan966x: avoid unregistering netdev on register failure - ice: fix locking in ice_dcb_rebuild() - tcp: Fix imbalanced icsk_accept_queue count. - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - netfilter: x_tables: unregister the templates first - ALSA: hda: cs35l56: Put ACPI device after setting companion - ARM: integrator: Fix early initialization - pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - kunit: config: KUNIT_DEBUGFS should depend on DEBUG_FS - kunit: config: Enable KUNIT_DEBUGFS by default - firmware: arm_ffa: Skip free_pages on RX buffer alloc failure - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration - HID: uclogic: Fix regression of input name assignment - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - batman-adv: tt: fix negative tt_buff_len - batman-adv: tt: fix negative last_changeset_len - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: fix fragment reassembly length accounting - batman-adv: dat: handle forward allocation error - batman-adv: clear current gateway during teardown - batman-adv: mcast: fix use-after-free in orig_node RCU release - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Fix integer overflow in bios_get_image() - drm/bridge: megachips: remove bridge when irq request fails - drm/bridge: it66121: acquire reset GPIO in probe - drm/virtio: use uninterruptible resv lock for plane updates - device property: set fwnode->secondary to NULL in fwnode_init() - LoongArch: Remove unused code to avoid build warning - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - spi: ti-qspi: fix use-after-free after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - scsi: isci: Fix use-after-free in device removal path - phy: tegra: xusb: Fix per-pad high-speed termination calibration - spi: qup: fix error pointer deref after DMA setup failure - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - arm64: probes: Handle probes on hinted conditional branch instructions - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - ice: fix setting promisc mode while adding VID filter - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - wifi: ath11k: clear shared SRNG pointer state on restart - vsock/vmci: fix UAF when peer resets connection during handshake - ring-buffer: Fix reporting of missed events in iterator - qed: fix double free in qed_cxt_tables_alloc() - netfilter: ipset: stop hash:* range iteration at end - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ip6t_hbh: reject oversized option lists - net: ifb: report ethtool stats over num_tx_queues - net: bcmgenet: keep RBUF EEE/PM disabled - phonet/pep: disable BH around forwarded sk_receive_skb() - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - drivers/base/memory: fix memory block reference leak in poison accounting - efi: Allocate runtime workqueue before ACPI init - ALSA: asihpi: Fix potential OOB array access at reading cache - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: ua101: Reject too-short USB descriptors - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - ksmbd: fix null pointer dereference in compare_guid_key() - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - sysfs: don't remove existing directory on update failure - Revert "af_unix: Reject SIOCATMARK on non-stream sockets" - Revert "s390/cio: Update purge function to unregister the unused subchannels" - Revert "ice: Remove jumbo_remove step from TX path" - Revert "ice: fix double-free of tx_buf skb" - Revert "x86/vdso: Fix output operand size of RDPID" - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - s390/debug: Reject zero-length input before trimming a newline - mptcp: pm: ADD_ADDR rtx: free sk if last - mptcp: sync the msk->sndbuf at accept() time - test_kprobes: clear kprobes between test runs - gcov: use atomic counter updates to fix concurrent access crashes - ixgbevf: fix use-after-free in VEPA multicast source pruning - powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del - perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - netfilter: revalidate bridge ports - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - udp: clear skb->dev before running a sockmap verdict - hisi-cca-da: Add new VFs to g_dev_protected when root dev was delegated - uvb: modify memremap in cis - iommu/ummu: Fix invalid TLBi for 64K granule in no-DVM KSVA/SVA - crypto: nx - Fix packed layout in struct nx842_crypto_header - crypto: nx - Use static_assert() to check struct sizes - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - Revert "ALSA: pcmtest: fix reference leak on failed device registration" - media: rc: ttusbir: fix inverted error logic - media: rc: igorplugusb: fix control request setup packet - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - batman-adv: stop tp_meter sessions during mesh teardown - ALSA: seq: Fix UMP group 16 filtering - ALSA: seq: Notify client and port info changes - ALSA: core: Serialize deferred fasync state checks - ALSA: misc: Use guard() for spin locks - ALSA: hda: cs35l56: Propagate ASP TX source control errors - crypto: nx - Avoid -Wflex-array-member-not-at-end warning - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - media: rc: igorplugusb: heed coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: i2sbus: clear stale prepared state - ALSA: aoa: Use guard() for mutex locks - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: replace connection list with hash table - ksmbd: use msleep instaed of schedule_timeout_interruptible() - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() - smb: move some duplicate definitions to common/smbacl.h - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - x86/shstk: Prevent deadlock during shstk sigreturn - ALSA: pcmtest: Fix resource leaks in module init error paths - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: 6fire: Fix input volume change detection - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: core: Fix potential data race at fasync handling - Revert "ALSA: usb-audio: Cap the packet size pre-calculations" - af_unix: Drop all SCM attributes for SOCKMAP. - bpf: Free reuseport cBPF prog after RCU grace period. - mm: mem_reliable: treat folio from dpool as unreliable - mm: reliable: remove the per-mm reliable page counter - mm: reliable: sched: assign a dedicated PF_RELIABLE bit instead of aliasing PF_KCOMPACTD - mm: reliable: vmscan: restrict reclaim to ZONE_MOVABLE for user allocations - ipv6: sit: reload inner IPv6 header after GSO offloads - net: guard timestamp cmsgs to real error queue skbs - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - netfilter: require Ethernet MAC header before using eth_hdr() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - Documentation/ub/ummu: Describe that iommu.passthrough is not supported - vsock/virtio: reset connection on receiving queue overflow - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - vsock/virtio: fix potential unbounded skb queue - sched/fair: Fix cfs_rq unused warning when CONFIG_QOS_SCHED is not set - sched/fair: Fix build error when CONFIG_QOS_SCHED is not set - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount - mptcp: pm: ADD_ADDR rtx: allow ID 0 - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - srcu: Use irq_work to start GP in tiny SRCU - irqwork: Move data struct to a types header - types: move struct rcuwait into types.h - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets - wifi: iwlwifi: fix 22000 series SMEM parsing - wifi: iwlwifi: allow IWL_FW_CHECK() with just a string - x86: shadow stacks: proper error handling for mmap lock - net: mvpp2: sync RX data at the hardware packet offset - net: mvpp2: limit XDP frame size to the RX buffer - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: v: stop OGMv2 on disabled interface - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - spi: mpc52xx: fix controller deregistration - zram: fix use-after-free in zram_bvec_write_partial() - iommu/ummu: Fix build issues for DKMS support - thunderbolt: Validate XDomain request packet size before type cast - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sctp: diag: reject stale associations in dump_one path - thunderbolt: Bound root directory content to block size - net/hinic5: fix code logic bug in the nic - gtp: disable BH before calling udp_tunnel_xmit_skb() - sctp: purge outqueue on stale COOKIE-ECHO handling - thunderbolt: Reject zero-length property entries in validator - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - selinux: fix overlayfs mmap() and mprotect() access checks - lsm: add backing_file LSM hooks - fs: constify file ptr in backing_file accessor helpers - fs: prepare for adding LSM blob to backing_file - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() - ub:ubus: Update ubus documetation to match latest code - ub:ubus: move ub memory event definition to uapi - ub:ubus: Support DKMS - Bluetooth: serialize accept_q access - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs - bpf: Fix ld_{abs,ind} failure path analysis in subprogs - KVM: x86: Fix shadow paging use-after-free due to unexpected role - Ethernet: Linkdata: remove mistakenly committed binary file - EDAC/i10nm: Add back CWF support - config: enable DMR EDAC driver - EDAC/imh: Setup 'imh_test' debugfs testing node - EDAC/{skx_comm,imh}: Detect 2-level memory configuration - EDAC/skx_common: Extend the maximum number of DRAM chip row bits - EDAC/{skx_common,imh}: Add EDAC driver for Intel Diamond Rapids servers - EDAC/skx_common: Prepare for skx_set_hi_lo() - EDAC/skx_common: Prepare for skx_get_edac_list() - EDAC/{skx_common,skx,i10nm}: Make skx_register_mci() independent of pci_dev - EDAC/{skx_common,skx}: Use configuration data, not global macros - USB: serial: io_ti: fix heap overflow in get_manuf_info() - drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED - drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - mm/madvise: add MADV_FCMA_ENABLE to set PF_FOLIO_CMA via madvise - ub: ubase: Modify the log for receiving the ctrlq message - ipc/shm: serialize orphan cleanup with shm_nattch updates - drm/virtio: Fix driver removal with disabled KMS - netfilter: nat: use kfree_rcu to release ops - drm/i915/gem: Fix phys BO pread/pwrite with offset - selinux: allow multiple opens of /sys/fs/selinux/policy - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - ksmbd: make ksmbd thread names distinct by client IP - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - ALSA: caiaq: fix usb_dev refcount leak on probe failure - ALSA: caiaq: Handle probe errors properly - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - ALSA: caiaq: take a reference on the USB device in create_card() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - smb: server: fix max_connections off-by-one in tcp accept path - smb: server: fix active_num_conn leak on transport allocation failure - usb: port: add delay after usb_hub_set_port_power() - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: storage: Expand range of matched versions for VL817 quirks entry - xfrm: Wait for RCU readers during policy netns exit - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - erofs: unify lcn as u64 for 32-bit platforms - padata: fix kabi breakage - padata: Put CPU offline callback in ONLINE section to allow failure - padata: Remove cpu online check from cpu add and removal - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - thunderbolt: Clamp XDomain response data copy to allocation size - bpf: return VMA snapshot from task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: fix mm lifecycle in open-coded task_vma iterator - iommu/vt-d: Fix oops due to out of scope access - netfilter: nft_ct: bail out on template ct in get eval - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - netfilter: conntrack_irc: fix possible out-of-bounds read - drm/vc4: fix krealloc() memory leak - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - f2fs: fix data loss caused by incorrect use of nat_entry flag - bnxt_en: Fix NULL pointer dereference - ipv6: mcast: Fix use-after-free when processing MLD queries - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - netlabel: validate unlabeled address and mask attribute lengths - netfilter: bridge: make ebt_snat ARP rewrite writable - tcp: restrict SO_ATTACH_FILTER to priv users - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - bus: fsl-mc: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure - iommu/amd: Fix clone_alias() to use the original device's devid - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - kernel/fork: clear PF_BLOCK_TS in copy_process() - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - Bluetooth: fix memory leak in error path of hci_alloc_dev() - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - gpio: mvebu: fix NULL pointer dereference in suspend/resume - cgroup/psi: Set of->priv to NULL upon file release - Bluetooth: bnep: reject short frames before parsing - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - RDMA/srp: bound SRP_RSP sense copy by the received length - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - sched/psi: fix race between file release and pressure write - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase - rculist: add list_splice_rcu() for private lists - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - ip6_vti: set netns_immutable on the fallback device. - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: debugfs: support multiple adapters debugging - ipc: limit next_id allocation to the valid ID range - USB: serial: kl5kusb105: fix bulk-out buffer overflow - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - drivers/ub/sentry: move msgid/timestamp init to callers and improve logging - erofs: fix use-after-free on sbi->sync_decompress - net: openvswitch: fix possible kfree_skb of ERR_PTR - net/oenetcls: validate last_recv_cpu against nr_cpu_ids before use - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - md: wake raid456 reshape waiters before suspend - dm cache policy smq: check allocation under invalidate lock - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: serial: io_edgeport: add support for Blackbox IC135A - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: flowtable: strictly check for maximum number of actions - powerpc/hv-gpci: fix preempt count leak in sysfs show paths - bpf: Fix s16 truncation for large bpf-to-bpf call offsets - bpf: Fix out-of-bounds read in bpf_patch_call_args() - fuse: reject fuse_notify() pagecache ops on directories - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios - fs/mbcache: cancel shrink work before destroying the cache - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - smb/client: fix possible infinite loop and oob read in symlink_data() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - drivers/ub/sentry: replace kthread with workqueue and add message dedup mechanism - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister" - xfs: remove xfs_attr_leaf_hasname - netfilter: nf_tables: use list_del_rcu for netlink hooks - nvmet-tcp: fix race between ICReq handling and queue teardown - riscv: traps: Add missing linux/nospec.h include - net/hinic5: Fix high-risk interfaces in the sdk - sched: fix cpu check logic in soft domain - sched: Fix kabi broken of struct sched_entity - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - sched/fair: Fix lag clamp - sched/fair: Fix math notation errors in avg_vruntime comment - x86/kexec: Disable KCOV instrumentation after load_segments() - KVM: arm64: Reject HDBSS enable when dirty ring is active - irqchip/gic-v3-its: Add DT cache clear count - net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close) - KVM: arm64: timer: Fix CCA/virtCCA confidential VM hang - ub: ub_fwctl: Correct spenlling issues in the document - !27774 drivers/ub/sentry: sync bugfix patches from OLK-6.6 - drivers/ub/sentry: Set tp_type to UBCORE_CTP before creating the tjetty - drivers/ub/sentry: fix binary msg printed as string in UVB callback - update kernel version to openEuler 6.6.0-59.0.0 - update kernel version to openEuler 6.6.0-66.0.0 - update kernel version to openEuler 6.6.0-68.0.0 - update kernel version to openEuler 6.6.0-72.0.0 - update kernel version to openEuler 6.6.0-75.0.0 - iommu: Hook up '->unmap_pages' driver callback - update kernel version to openEuler 6.6.0-84.0.0 - update Raspberry Pi patch, last commit (f1076a9d7a269d72b6707283560d0d38203cb07a): delete the comment - add sub package: raspberrypi-kernel-headers - fix file erros in raspberrypi-kernel-develchangel - upgrade to 6.6.0-152.0.0 - upgrade to 6.6.0-155.0.0 - upgrade to 6.6.0-159.4.1 - update kernel version to openEuler 6.6.0-59.0.0 - update kernel version to openEuler 6.6.0-66.0.0 - update kernel version to openEuler 6.6.0-68.0.0 - update kernel version to openEuler 6.6.0-72.0.0 - update kernel version to openEuler 6.6.0-75.0.0 - iommu: Hook up '->unmap_pages' driver callback - update kernel version to openEuler 6.6.0-84.0.0 - update Raspberry Pi patch, last commit (f1076a9d7a269d72b6707283560d0d38203cb07a): delete the comment - add sub package: raspberrypi-kernel-headers - fix file erros in raspberrypi-kernel-develchangel - upgrade to 6.6.0-152.0.0 - upgrade to 6.6.0-155.0.0 - upgrade to 6.6.0-159.4.1 - update kernel version to openEuler 6.6.0-59.0.0 - update kernel version to openEuler 6.6.0-66.0.0 - update kernel version to openEuler 6.6.0-68.0.0 - update kernel version to openEuler 6.6.0-72.0.0 - update kernel version to openEuler 6.6.0-75.0.0 - iommu: Hook up '->unmap_pages' driver callback - update kernel version to openEuler 6.6.0-84.0.0 - update Raspberry Pi patch, last commit (f1076a9d7a269d72b6707283560d0d38203cb07a): delete the comment - add sub package: raspberrypi-kernel-headers - fix file erros in raspberrypi-kernel-develchangel - upgrade to 6.6.0-152.0.0 - upgrade to 6.6.0-155.0.0 - upgrade to 6.6.0-159.4.1 - update kernel version to openEuler 6.6.0-59.0.0 - update kernel version to openEuler 6.6.0-66.0.0 - update kernel version to openEuler 6.6.0-68.0.0 - update kernel version to openEuler 6.6.0-72.0.0 - update kernel version to openEuler 6.6.0-75.0.0 - iommu: Hook up '->unmap_pages' driver callback - update kernel version to openEuler 6.6.0-84.0.0 - update Raspberry Pi patch, last commit (f1076a9d7a269d72b6707283560d0d38203cb07a): delete the comment - add sub package: raspberrypi-kernel-headers - fix file erros in raspberrypi-kernel-develchangel - upgrade to 6.6.0-152.0.0 - upgrade to 6.6.0-155.0.0 - upgrade to 6.6.0-159.4.1 - - update Rpi:preempt-RT to openEuler 6.6.0.62.3.0 - - update Rpi:preempt-RT to openEuler 6.6.0.154.4.0 - - update Rpi:preempt-RT to openEuler 6.6.0.62.3.0 - - update Rpi:preempt-RT to openEuler 6.6.0.154.4.0 - - update Rpi:preempt-RT to openEuler 6.6.0.62.3.0 - - update Rpi:preempt-RT to openEuler 6.6.0.154.4.0 - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling - urma: update udma drop blanket -Wno-error, reject out-of-range order_type in, add uboe combination, and change type of bdp_tseg - umdk: update cam Add WQE filling, fix umq test code, fix -p 2 not, module updates, and cam Add static checks - umq: update fix umq thread closure, fix the error in, support jfr lock_free, and change spin lock to - umdk: drop stale paths from refreshed tarball - umdk: update cam Add implementation of, cam Add FP8/FP4 dtype, cam Add integration of, and cam Adapt to shmem - urma: update fix failback second roll, Fix the issue where, fix bonding wr list, and avoid to alloc wr_buffer - umq: update add trace for post, Fix the issue of, fix logic umq credit_clean_up, and add trace timestamp/umq_id - umdk: drop stale paths from refreshed tarball - urma: update docs sync URMA API, docs fix URMA Jetty, docs number segment context, and docs fix delete notifier - umdk: update cam build NDA module, fix umq fost rx, cam fix cann8 5, and ums fix kmod build - umq: update do not allocate credit, avoid fc send eagain, fix the issue where, optimize log, and fix mismatch param type/num - umdk: drop stale paths from refreshed tarball - urma: update udma bugfix related to, make bond CR batch, rename bond topology utility, and fix test case jetty - umq: update fix poll rx core, fix errno and update, fix the umq_ctx error, and add remote eid/jetty_id info - umdk: update cam Update the base and fix - umdk: drop stale paths from refreshed tarball - urma: update return EINVAL for oversize, reorder jetty destruction before, optimize bondp_target_jetty_t memory with, qilin-sp4, preserve perftest final synchronization, and youhua - umq: update add a thread name, fix the issue where, Add without-data buffers to, and add error log for - umdk: update cam accommodate shmem changes, cam fix cam master, cam fix shmem transport, and cam add zero-buffer MoE - urpc: update docs fix documentation drift and docs refine generated documentation - dlock: fix docs fix documentation drift - urma: update move cfg_check from alloc, expand bond imm_data user, share health-check seg at, and shrink wr_list to 256 - umdk: update cam NDA control plane, cam add NDA cq, cam fix layout input, and cam add fp16 datatype - umq: update modify perf accuracy to, control tx outstanding, optimize memory usage when, and when a CQE ACK - umdk: drop stale paths from refreshed tarball - urma: update support bondingEID sharing mode, use is_empty_eid instead of, fix ASAN violations null, and document failback jetty isolation - umdk: update ums update docs add - umq: update fix code format, optimize the log printing, change the initial number, and allocate memory for rx_consumed_jetty_table - urma: update docs fix documentation drift, udma bugfix related to, change the path selection, and allocate bond post buffers - umq: update support bind itself, adapt umq_ub_dev_info_serialize to urma_get/put_seg_ctx, add trace descrition, perftest support share jfr, and Restore bonding port reconfigurability - urma: update fix ub mgmt handshake, allow user to handle, report RNR flow control, and optimize bondp_target_jetty_t memory usage - umq: update optimize umq_t memory usage, add rnr retry errno, support flush jetty node, and add opcode print for - umdk: update cam fix zb normal, fix tp_type parse error, udma delete excess patch, and update test doc - urpc: update fix umq TLS release_thread_cache, fix g_tls_dtors_running flag set, and fix umq codecheck - - umdk: drop stale paths from refreshed tarball - umdk: update add CODEOWNERS to require, cam add doc files, and cam Fixed an intermittent - urma: update add dt simulator build, fix coredump when delete, no import seg in, and refine bond resource deletion - umq: update support share jetty main, set rx_block_count and add, fix umq_ub close TOCTOU, id generator allocation increases, and out-of-bound handling