- update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - !23508 v2 bpf: Remove smap argument from bpf_selem_free() - !23457 v2 bpf mainline - !23442 ub: udma&ubase: add get tp list function. - !23415 drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - ub: udma: add get tp list function. - !22887 [OLK-6.6] urma: fix RNR ERR under CTP mode in IPoURMA - !23416 urma: implement kernel-space get tp list with hash table. - bpf: Remove smap argument from bpf_selem_free() - urma: implement kernel-space get tp list with hash table. - !23418 bpf: Avoid soft lockup in bpf_uprobe_unregister - drivers/ub/sentry: adapt to ubcore_get_tp_list semantic change - !23229 obmm: add feature-based enable control - !23362 CVE-2026-43201 - !23351 Fix CVE-2026-43292 - !22903 [OLK-6.6][linux-6.6.y sync] Backport 6.6.128-6.6.141 LTS Patches - !23228 obmm: fix VMA access for ptrace/GDB on export regions - selftests/bpf: Add test for stale pkt range after scalar arithmetic - bpf: Drop pkt_end markers on arithmetic to prevent is_pkt_ptr_branch_taken - obmm: add feature-based enable control - !23374 urma: increase topo max node limit to 1024 - !23403 urma: add v2p function in kernel for dfx such as urma_admin - netfs: Fix potential uninitialised var in netfs_extract_user_iter() - net/rds: reset op_nents when zerocopy page pin fails - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - mptcp: pm: ADD_ADDR rtx: fix potential data-race - spi: sifive: fix controller deregistration - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 - spi: st-ssc4: fix controller deregistration - spi: st-ssc4: switch to use modern name - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - f2fs: fix false alarm of lockdep on cp_global_sem lock - f2fs: fix incorrect file address mapping when inline inode is unwritten - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: prio: skip closed subflows - mptcp: fix rx timestamp corruption on fastopen - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - RDMA/mana: Validate rx_hash_key_len - btrfs: fix missing last_unlink_trans update when removing a directory - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: use inode already stored in local variable at btrfs_rmdir() - smb: client: Use FullSessionKey for AES-256 encryption key derivation - drm/v3d: Reject empty multisync extension to prevent infinite loop - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - pmdomain: core: Fix detach procedure for virtual devices in genpd - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/i915: skip __i915_request_skip() for already signaled requests - iommu/vt-d: Disable DMAR for Intel Q35 IGFX - libceph: handle rbtree insertion error in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in osdmap_decode() - netfs: fix error handling in netfs_extract_user_iter() - powerpc/warp: Fix error handling in pika_dtm_thread - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - ceph: fix a buffer leak in __ceph_setxattr() - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ASoC: SOF: Intel: hda: Fix NULL pointer dereference - ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond HDAudio - ASoC: SOF: Intel: hda-dai: remove dspless special case - KVM: x86: Fix Xen hypercall tracepoint argument assignment - KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - netfilter: nft_ct: fix missing expect put in obj eval - audit: fix incorrect inheritable capability in CAPSET records - netfilter: nf_conntrack_sip: get helper before allocating expectation - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - i40e: Cleanup PTP pins on probe failure - crypto: af_alg - Cap AEAD AD length to 0x80000000 - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - ksmbd: validate response sizes in ipc_validate_msg() - net: bcmgenet: fix leaking free_bds - net: bcmgenet: Initialize u64 stats seq counter - crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx - ntfs: ->d_compare() must not block - net/sched: cls_flower: revert unintended changes - sfc: fix error code in efx_devlink_info_running_versions() - net: tls: fix strparser anchor skb leak on offload RX setup failure - ice: fix NULL pointer dereference in ice_reset_all_vfs() - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - iavf: wait for PF confirmation before removing VLAN filters - iavf: stop removing VLAN filters from PF on interface down - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/amd/display: Allow DCE link encoder without AUX registers - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: fix some typos - netconsole: propagate device name truncation in dev_name_store() - net: netconsole: move newline trimming to function - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - ipv6: rename and move ip6_dst_lookup_tunnel() - ipv4: add new arguments to udp_tunnel_dst_lookup() - ipv4: remove "proto" argument from udp_tunnel_dst_lookup() - ipv4: rename and move ip_route_output_tunnel() - sctp: discard stale INIT after handshake completion - netfilter: skip recording stale or retransmitted INIT - ASoC: codecs: ab8500: Fix casting of private data - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - net: phy: dp83869: fix setting CLK_O_SEL field. - net: mctp i2c: check length before marking flow active - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - neigh: let neigh_xmit take skb ownership - neighbour: add RCU protection to neigh_tables[] - net/sched: taprio: fix NULL pointer dereference in class dump - NFC: trf7970a: Ignore antenna noise when checking for RF field - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - vrf: Fix a potential NPD when removing a port from a VRF - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: netem: check for negative latency and jitter - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: validate slot configuration - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: fix probability gaps in 4-state loss model - netdevsim: zero initialize struct iphdr in dummy sk_buff - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - arm64/scs: Fix potential sign extension issue of advance_loc4 - drm/sysfb: ofdrm: fix PCI device reference leaks - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - netfilter: nf_conntrack_sip: don't use simple_strtoul - netfilter: xt_policy: fix strict mode inbound policy matching - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu: fix spelling typos - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - nvme-pci: fix missed admin queue sq doorbell write - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - mailbox: mailbox-test: make data_ready a per-instance variable - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: don't free the reused channel - mailbox: add sanity check for channel array - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: mailbox-test: free channels on probe error - fbdev: offb: fix PCI device reference leak on probe failure - rtc: abx80x: Disable alarm feature if no interrupt attached - fs/adfs: validate nzones in adfs_validate_bblk() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - tipc: fix double-free in tipc_buf_append() - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/rds: zero per-item info buffer before handing it to visitors - ksmbd: scope conn->binding slowpath to bound sessions only - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: add support for supplementary groups - ksmbd: Use struct_size() to improve smb_direct_rdma_xmit() - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number - slip: bound decode() reads against the compressed packet length - slip: reject VJ receive packets on instances with no rstate array - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: xtables: restrict several matches to inet family - netfilter: conntrack: remove sprintf usage - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: nft_osf: restrict it to ipv4 - openvswitch: cap upcall PID array size and pre-size vport replies - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - ipv6: fix possible UAF in icmpv6_rcv() - e1000e: Unroll PTP in probe error handling - i40e: don't advertise IFF_SUPP_NOFCS - ice: fix double-free of tx_buf skb - ice: Remove jumbo_remove step from TX path - tcp: annotate data-races around tp->plb_rehash - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->bytes_sent - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - crypto: ccp - copy IV using skcipher ivsize - crypto: sa2ul - Fix AEAD fallback algorithm names - drm/i915/wm: Verify the correct plane DDB entry - drm/i915: Loop over all active pipes in intel_mbus_dbox_update - drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update() - drm/i915: Simplify watermark state checker calling convention - drm/i915: Constify watermark state checker - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - f2fs: Use sysfs_emit_at() to simplify code - clk: visconti: pll: initialize clk_init_data to zero - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: dispcc-sc7180: Add missing MDSS resets - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: xgene: Fix mapping leak in xgene_pllclk_init() - clk: qoriq: avoid format string warning - clk: imx8mq: Correct the CSI PHY sels - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Add missing GDSCs - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - scsi: target: core: Fix integer overflow in UNMAP bounds check - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Make sg_sysfs_class constant - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - RDMA/core: Prefer NLA_NUL_STRING - platform/x86: dell-wmi-sysman: bound enumeration string aggregation - platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - tty: hvc_iucv: fix off-by-one in number of supported devices - leds: lgm-sso: Remove duplicate assignments for priv->mmap - platform/surface: surfacepro3_button: Drop wakeup source on remove - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - dev_printk: add new dev_err_probe() helpers - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - perf util: Kill die() prototype, dead for a long time - ipmi: ssif_bmc: change log level to dbg in irq callback - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - perf expr: Return -EINVAL for syntax error in expr__find_ids() - perf lock: Fix option value type in parse_max_stack - pinctrl: abx500: Fix type of 'argument' variable - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - perf branch: Avoid incrementing NULL - pinctrl: cy8c95x0: Avoid returning positive values to user space - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: pinctrl-pic32: Fix resource leak - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf, sockmap: Take state lock for af_unix iter - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Fix af_unix iter deadlock - HID: usbhid: fix deadlock in hid_post_reset() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: physmap_of_gemini: Fix disabled pinctrl state check - HID: asus: do not abort probe when not necessary - HID: asus: make asus_resume adhere to linux kernel coding standards - ima: check return value of crypto_shash_final() in boot aggregate - soundwire: cadence: Clear message complete before signaling waiting thread - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - ocfs2: validate group add input before caching - ocfs2: validate bg_bits during freefrag scan - ocfs2: fix listxattr handling when the buffer is full - ARM: dts: imx27-eukrea: replace interrupts with interrupts-extended - arm64/xor: fix conflicting attributes for xor_block_template - ARM: OMAP1: Fix DEBUG_LL and earlyprintk on OMAP16XX - arm64: dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - soc: qcom: aoss: compare against normalized cooling state - soc: qcom: llcc: fix v1 SB syndrome register offset - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - soc/tegra: cbb: Set ERD on resume for err interrupt - arm64: dts: imx8qxp-mek: switch Type-C connector power-role to dual - arm64: dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - arm64: dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - arm64: dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - arm64: dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - arm64: dts: qcom: sm8550: Fix GIC_ITS range length - arm64: dts: qcom: sm8450: Fix GIC_ITS range length - soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - soc: qcom: ocmem: register reasons for probe deferrals - soc: qcom: ocmem: use scoped device node handling to simplify error paths - soc: qcom: ocmem: make the core clock optional - arm64: dts: qcom: msm8953-xiaomi-daisy: fix backlight - arm64: dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - arm64: dts: mediatek: mt7986a: Fix gpio-ranges pin count - arm64: dts: mediatek: mt6795: Fix gpio-ranges pin count - arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - arm64: dts: imx8-apalis: Fix LEDs name collision - memory: tegra30-emc: Fix dll_change check - memory: tegra124-emc: Fix dll_change check - ARM: dts: mediatek: mt7623: fix efuse fallback compatible - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - gfs2: prevent NULL pointer dereference during unmount - gfs2: add some missing log locking - quota: Fix race of dquot_scan_active() with quota deactivation - ktest: Run POST_KTEST hooks on failure and cancellation - ktest: Honor empty per-test option overrides - ktest: Avoid undef warning when WARNINGS_FILE is unset - gfs2: Call unlock_new_inode before d_instantiate - crypto: jitterentropy - replace long-held spinlock with mutex - dm cache: fix missing return in invalidate_committed's error path - ALSA: sc6000: Keep the programmed board state in card-private data - ALSA: sc6000: Use standard print API - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Use DWC IP core version - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Fix polling delay for L2 state - ASoC: SOF: compress: return the configured codec from get_params - ALSA: scarlett2: Add missing sentinel initializer field - selftest: memcg: skip memcg_sock test if address family not supported - Documentation: fix a hugetlbfs reservation statement - selftests/mm: skip migration tests if NUMA is unavailable - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - PCI: Enable AtomicOps only if Root Port supports them - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - crypto: qat - use swab32 macro - ASoC: qcom: qdsp6: topology: check widget type before accessing data - ASoC: fsl_easrc: Change the type for iec958 channel status controls - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Add access property for "VAD Detected" - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - pmdomain: ti: omap_prm: Fix a reference leak on device node - drm/msm/a6xx: Use barriers while updating HFI Q headers - drm/msm/shrinker: Fix can_block() logic - drm/msm/a6xx: Fix HLSQ register dumping - ASoC: SOF: Intel: hda: Place check before dereference - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - ALSA: core: Validate compress device numbers without dynamic minors - drm/panel: simple: Correct G190EAN01 prepare timing - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/msm/dsi: add the missing parameter description - drm/msm/dpu: fix mismatch between power and frequency - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel - Remove cfb and ofb - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - dm init: ensure device probing has finished in dm-mod.waitfor= - drm/amdgpu: Add default case in DVI mode validation - drm/sun4i: Fix resource leaks - spi: fsl-qspi: Use reinit_completion() for repeated operations - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - dm log: fix out-of-bounds write due to region_count overflow - dm cache metadata: fix memory leak on metadata abort retry - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - dm cache: fix dirty mapping checking in passthrough mode switching - dm cache: support shrinking the origin device - dm cache: fix concurrent write failure in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix write hang in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix null-deref with concurrent writes in passthrough mode - ASoC: sti: use managed regmap_field allocations - ASoC: sti: Return errors from regmap_field_alloc() - drm/sun4i: backend: fix error pointer dereference - drm/komeda: fix integer overflow in AFBC framebuffer size check - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - sctp: fix missing encap_port propagation for GSO fragments - net: phy: qcom: at803x: Use the correct bit to disable extended next page - net: phy: move at803x PHY driver to dedicated directory - net: phy: add Rust Asix PHY driver - net: phy: aquantia: move to separate directory - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - net/mlx5e: Fix features not applied during netdev registration - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net/rds: Restrict use of RDS/IB to the initial network namespace - net/rds: Optimize rds_ib_laddr_check - net/sched: act_ct: Only release RCU read lock after ct_ft - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - 6pack: propagage new tty types - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - netfilter: xt_socket: enable defrag after all other checks - net: bcmgenet: fix racing timeout handler - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: Remove custom ndo_poll_controller() - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - arm64: kexec: Remove duplicate allocation for trans_pgd - ACPI: AGDI: fix missing newline in error message - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: brcmfmac: Fix error pointer dereference - macvlan: annotate data-races around port->bc_queue_len_used - selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 - selftests/powerpc: Re-order *FLAGS to follow lib.mk - powerpc/crash: fix backup region offset update to elfcorehdr - r8152: fix incorrect register write to USB_UPHY_XTAL - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - arm64: cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - params: Replace __modinit with __init_or_module - s390/bpf: Zero-extend bpf prog return values and kfunc arguments - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - bpf: Add CHECKSUM_COMPLETE to bpf test progs - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - firmware: dmi: Correct an indexing error in dmi.h - locking: Fix rwlock support in <linux/spinlock_up.h> - hrtimer: Reduce trace noise in hrtimer_start() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimers: Update the return type of enqueue_hrtimer() - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - s390/cio: use generic driver_override infrastructure - s390/cio: convert sprintf()/snprintf() to sysfs_emit() - s390/cio: make sch->lock spinlock pointer a member - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - debugfs: check for NULL pointer in debugfs_create_str() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - devres: fix missing node debug info in devm_krealloc() - ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - ACPI: x86: cmos_rtc: Clean up address space handler driver - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - loop: fix partition scan race between udev and loop_reread_partitions() - drbd: Balance RCU calls in drbd_adm_dump_devices() - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - blk-cgroup: wait for blkcg cleanup before initializing new disk - smb: client: use kzalloc to zero-initialize security descriptor buffer - mtd: spi-nor: sst: Fix SST write failure - drm/amdgpu/vcn4: Avoid overflow on msg bound check - drm/amdgpu/vcn3: Avoid overflow on msg bound check - vsock/virtio: fix length and offset in tap skb for split packets - vsock: fix buffer size clamping order - KVM: arm64: Wake-up from WFI when iqrchip is in userspace - usb: dwc3: Move GUID programming after PHY initialization - tracing/probes: Limit size of event probe to 3K - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - pwm: imx-tpm: Count the number of enabled channels in probe - mtd: spi-nor: sst: Fix write enable before AAI sequence - mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - usb: typec: tcpm: reset internal port states on soft reset AMS - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/core: implement damon_kdamond_pid() - mm/damon/core: disallow time-quota setting zero esz - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - fbcon: Avoid OOB font access if console rotation fails - spi: microchip-core-qspi: fix controller deregistration - spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() - mm/hugetlb_cma: round up per_node before logging it - spi: uniphier: fix controller deregistration - spi: uniphier: Simplify clock handling with devm_clk_get_enabled() - spi: uniphier: switch to use modern name - spi: tegra20-sflash: fix controller deregistration - spi: tegra114: fix controller deregistration - spi: sun6i: fix controller deregistration - spi: sun6i: switch to use modern name - spi: zynq-qspi: fix controller deregistration - spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() - spi: zynq-qspi: switch to use modern name - spi: ti-qspi: fix controller deregistration - spi: spi-ti-qspi: switch to use modern name - spi: spi-ti-qspi: Convert to platform remove callback returning void - spi: sun4i: fix controller deregistration - spi: sun4i: switch to use modern name - spi: syncuacer: fix controller deregistration - spi: synquacer: switch to use modern name - Bluetooth: hci_conn: fix potential UAF in create_big_sync - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - xfrm: ah: account for ESN high bits in async callbacks - net: ipv6: stop checking crypto_ahash_alignmask - net: ipv4: stop checking crypto_ahash_alignmask - net: stmmac: Prevent NULL deref when RX memory exhausted - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: avoid shadowing global buf_sz - crypto: caam - guard HMAC key hex dumps in hash_digest_key - printk: add print_hex_dump_devel() - wifi: rtl8xxxu: fix potential use of uninitialized value - hfsplus: fix held lock freed on hfsplus_fill_super() - hfsplus: fix uninit-value by validating catalog record size - xfs: fix a resource leak in xfs_alloc_buftarg() - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - firmware: google: framebuffer: Do not unregister platform device - spi: fix resource leaks on device setup failure - net: qrtr: ns: Limit the total number of nodes - net: qrtr: ns: Limit the maximum number of lookups - net: qrtr: ns: Limit the maximum server registration per node - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - RDMA/mana_ib: Disable RX steering on RSS QP destroy - sched: Use u64 for bandwidth ratio calculations - block: relax pgmap check in bio_add_page for compatible zone device pages - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: connac: introduce helper for mt7925 chipset - lib: test_hmm: evict device pages on file close to avoid use-after-free - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - batman-adv: bla: put backbone reference on failed claim hash insert - batman-adv: bla: only purge non-released claims - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: reject new tp_meter sessions during teardown - batman-adv: fix integer overflow on buff_pos - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/amdgpu: zero-initialize GART table on allocation - drm/radeon: add missing revision check for CI - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - spi: cadence: fix unclocked access on unbind - spi: cadence: fix controller deregistration - spi: mpc52xx: fix use-after-free on unbind - spi: orion: fix clock imbalance on registration failure - spi: orion: fix runtime pm leak on unbind - spi: imx: fix runtime pm leak on probe deferral - spi: img-spfi: fix controller deregistration - spi: rspi: fix controller deregistration - spi: sprd: fix controller deregistration - spi: coldfire-qspi: fix controller deregistration - spi: bcmbca-hsspi: fix controller deregistration - spi: fsl: fix controller deregistration - spi: sh-hspi: fix controller deregistration - spi: mtk-nor: fix controller deregistration - spi: omap2-mcspi: fix controller deregistration - spi: fsl-espi: fix controller deregistration - spi: s3c64xx: fix controller deregistration - spi: dln2: fix controller deregistration - media: omap3isp: drop the use count of v4l2 pipeline - media: i2c: ov08d10: fix image vertical start setting - media: staging: imx: request mbus_config in csi_start - media: i2c: imx412: Assert reset GPIO during probe - media: dib8000: avoid division by 0 in dib8000_set_dds() - media: pci: zoran: fix potential memory leak in zoran_probe() - platform/x86: hp-wmi: Ignore backlight and FnLock events - media: saa7164: add ioremap return checks and cleanups - spi: at91-usart: fix controller deregistration - spi: qup: fix controller deregistration - spi: lantiq-ssc: fix controller deregistration - regulator: bd9571mwv: fix OF node reference imbalance - regulator: act8945a: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - regulator: rk808: fix OF node reference imbalance - media: rc: streamzap: Error handling in probe - media: rc: xbox_remote: heed DMA restrictions - regulator: max77650: fix OF node reference imbalance - regulator: mt6357: fix OF node reference imbalance - staging: media: atomisp: Disallow all private IOCTLs - spi: atmel: fix controller deregistration - spi: bcm63xx: fix controller deregistration - media: i2c: ov8856: free control handler on error in ov8856_init_controls() - media: uvcvideo: Enable VB2_DMABUF for metadata stream - HID: playstation: Clamp num_touch_reports - exit: Sleep at TASK_IDLE when waiting for application core dump - LoongArch: Use per-root-bridge PCIH flag to skip mem resource fixup - LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang() - KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - mptcp: fix scheduling with atomic in timestamp sockopt - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: fastclose msk when linger time is 0 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - power: supply: max17042: avoid overflow when determining health - PCI/AER: Stop ruling out unbound devices as error source - PCI/AER: Clear only error bits in PCIe Device Status - KVM: x86: check for nEPT/nNPT in slow flush hypercalls - smb: client: validate dacloffset before building DACL pointers - smb/client: fix out-of-bounds read in symlink_data() - smb/client: fix out-of-bounds read in smb2_compound_op() - s390/debug: Reject zero-length input in debug_input_flush_fn() - RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - nvme-apple: drop invalid put of admin queue reference count - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - libceph: Fix slab-out-of-bounds access in auth message processing - lib/scatterlist: fix temp buffer in extract_user_to_sg() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - isofs: validate block number from NFS file handle in isofs_export_iget - isofs: validate Rock Ridge CE continuation extent against volume size - dm-verity-fec: correctly reject too-small hash devices - dm-verity-fec: correctly reject too-small FEC devices - dm: fix a buffer overflow in ioctl processing - dm: don't report warning when doing deferred remove - dm-thin: fix metadata refcount underflow - ASoC: qcom: q6apm: remove child devices when apm is removed - ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error - ASoC: fsl_easrc: fix comment typo - ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - cpuidle: powerpc: avoid double clear when breaking snooze - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - clk: imx: imx8-acm: fix flags for acm clocks - spi: topcliff-pch: fix use-after-free on unbind - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - udf: reject descriptors with oversized CRC length - ibmveth: Disable GSO for packets with small MSS - hv_sock: fix ARM64 support - gpio: of: clear OF_POPULATED on hog nodes in remove path - extcon: ptn5150: handle pending IRQ events during system resume - cifs: change_conf needs to be called for session setup - cifs: abort open_cached_dir if we don't request leases - block: add pgmap check to biovec_phys_mergeable - af_unix: Reject SIOCATMARK on non-stream sockets - hwmon: (corsair-psu) Close HID device on probe errors - clk: rk808: fix OF node reference imbalance - hwmon: (ltc2992) Fix u32 overflow in power read path - hwmon: (ltc2992) Clamp threshold writes to hardware range - parisc: Fix IRQ leak in LASI driver - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - net/rds: handle zerocopy send cleanup before the message is queued - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net: libwx: fix VF illegal register access - sound: ua101: fix division by zero at probe - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - fanotify: fix false positive on permission events - staging: vme_user: fix root device leak on init failure - spi: s3c64xx: fix NULL-deref on driver unbind - spi: zynqmp-gqspi: fix controller deregistration - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: virtio_bt: clamp rx length before skb_put - selinux: prune /sys/fs/selinux/disable - selinux: shrink critical section in sel_write_load() - selinux: don't reserve xattr slot when we won't fill it - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: provide message size for XFRM_MSG_MAPPING - powerpc/kdump: fix KASAN sanitization flag for core_$(BITS).o - ALSA: firewire-tascam: Do not drop unread control events - USB: serial: option: add Telit Cinterion LE910Cx compositions - USB: omap_udc: DMA: Don't enable burst 4 mode - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: midi2: Restart output URBs on resume - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: mac80211: remove station if connection prep fails - wifi: ath5k: do not access array OOB - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: mt76: mt7921: fix a potential clc buffer length underflow - exit: prevent preemption of oopsing TASK_DEAD task - selftests/bpf: validate fake register spill/fill precision backtracking logic - selftests/bpf: validate precision logic in partial_stack_load_preserves_zeros - selftests/bpf: validate zero preservation for sub-slot loads - selftests/bpf: validate STACK_ZERO is preserved on subreg spill - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - KVM: SVM: check validity of VMCB controls when returning from SMM - flow_dissector: do not dissect PPPoE PFC frames - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - rxrpc: Fix potential UAF after skb_unshare() failure - spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: rockchip: fix controller deregistration - ASoC: SOF: Don't allow pointer operations on unconfigured streams - iommufd: Fix a race with concurrent allocation and unmap - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: scan: Use acpi_dev_put() in object add error paths - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ipmi:si: Return state to normal if message allocation fails - ipmi: Check event message buffer response for bad data - ipmi: Add limits to event and receive message requests - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - netfilter: reject zero shift in nft_bitwise - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - rtmutex: Use waiter::task instead of current in remove_waiter() - ntfs3: fix integer overflow in run_unpack() volume boundary check - ntfs3: add buffer boundary checks to run_unpack() - ktest: Fix the month in the name of the failure directory - IB/core: Fix zero dmac race in neighbor resolution - dm mirror: fix integer overflow in create_dirty_log() - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-tdes - fix DMA sync direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: atmel-ecc - Release client on allocation failure - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - can: ucan: fix devres lifetime - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - taskstats: set version in TGID exit notifications - tcp: call sk_data_ready() after listener migration - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - md/raid5: validate payload size before accessing journal metadata - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - mtd: docg3: fix use-after-free in docg3_release() - mtd: docg3: Convert to platform remove callback returning void - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - userfaultfd: allow registration of ranges below mmap_min_addr - mm/damon/core: use time_in_range_open() for damos quota window start - rtc: ntxec: fix OF node reference imbalance - tpm: tpm_tis: stop transmit if retries are exhausted - tpm: tpm_tis: add error logging for data transfer - crypto: talitos - rename first/last to first_desc/last_desc - crypto: talitos - fix SEC1 32k ahash request limitation - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - mmc: block: use single block write in retry - power: supply: axp288_charger: Do not cancel work before initializing it - LoongArch: Show CPU vulnerabilites correctly - tpm: avoid -Wunused-but-set-variable - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - ipv4: icmp: validate reply type before using icmp_pointers - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - drm/arcpgu: fix device node leak - net: ks8851: Avoid excess softirq scheduling - net: ks8851: Reinstate disabling of BHs around IRQ handler - net/smc: avoid early lgr access in smc_clc_wait_msg - net: rds: fix MR cleanup on copy error - net: qrtr: ns: Free the node during ctrl_cmd_bye() - tools/accounting: handle truncated taskstats netlink messages - rxrpc: Fix re-decryption of RESPONSE packets - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix memory leaks in rxkad_verify_response() - iio: adc: ad7768-1: fix one-shot mode data acquisition - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - io_uring/poll: fix signed comparison in io_poll_get_ownership() - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/timeout: check unused sqe fields - rbd: fix null-ptr-deref when device_add_disk() fails - selftests/mqueue: Fix incorrectly named file - remoteproc: xlnx: Only access buffer information if IPI is buffered - parisc: _llseek syscall is only available for 32-bit userspace - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - md/raid10: fix deadlock with check operation and nowait requests - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: aoa: i2sbus: fix OF node lifetime handling - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - lib/ts_kmp: fix integer overflow in pattern length calculation - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - net: strparser: fix skb_head leak in strp_abort_strp() - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - media: amphion: Fix race between m2m job_abort and device_run - of: unittest: fix use-after-free in testdrv_probe() - spi: imx: fix use-after-free on unbind - um: drivers: call kernel_strrchr() explicitly in cow_user.c - wifi: rtw88: check for PCI upstream bridge existence - zram: do not forget to endio for partial discard requests - LoongArch: Add spectre boundry for syscall dispatch table - ocfs2: split transactions in dio completion to avoid credit exhaustion - regset: use kvzalloc() for regset_get_alloc() - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - padata: Remove comment for reorder_work - firmware: google: framebuffer: Do not mark framebuffer as busy - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - ibmasm: fix OOB reads in command_file_write due to missing size checks - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - leds: qcom-lpg: Check for array overflow when selecting the high resolution - ALSA: usb-audio: Evaluate packsize caps at the right place - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - Buffer overflow in drivers/xen/sys-hypervisor.c - md/raid1: fix data lost for writemostly rdev - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing - crypto: testmgr - Hide ENOENT errors better - crypto: testmgr - Hide ENOENT errors - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - fuse: quiet down complaints in fuse_conn_limit_write - fuse: Check for large folio with SPLICE_F_MOVE - fuse: reject oversized dirents in page cache - f2fs: fix to avoid memory leak in f2fs_rename() - fs/ntfs3: validate rec->used in journal-replay file record check - rxrpc: only handle RESPONSE during service challenge - rxrpc: Fix anonymous key handling - scripts/dtc: Remove unused dts_version in dtc-lexer.l - Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - ocfs2: validate inline data i_size during inode read - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - rxrpc: Fix key quota calculation for multitoken keys - scripts: generate_rust_analyzer.py: define scripts - net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - Revert "perf unwind-libdw: Fix invalid reference counts" - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - media: vidtv: fix pass-by-value structs causing MSAN warnings - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - ALSA: 6fire: fix use-after-free on disconnect - media: em28xx: fix use-after-free in em28xx_v4l2_open() - media: mediatek: vcodec: fix use-after-free in encoder release path - media: vidtv: fix nfeeds state corruption on start_streaming failure - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - mm/kasan: fix double free for kasan pXds - ASoC: qcom: q6apm: move component registration to unmanaged version - checkpatch: add support for Assisted-by tag - nfc: nci: complete pending data exchange on device close - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - KVM: nVMX: Fold requested virtual interrupt check into has_nested_events() - btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() - ocfs2: handle invalid dinode in ocfs2_group_extend - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: fix possible deadlock between unlink and dio_end_io_write - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - USB: serial: option: add Telit Cinterion FN990A MBIM composition - staging: sm750fb: fix division by zero in ps_to_hz() - wifi: rtw88: fix device leak on probe failure - scripts: generate_rust_analyzer.py: avoid FD leak - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: validate EaNameLength in smb2_get_ea() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - ALSA: fireworks: bound device-supplied status before string array lookup - drm/vc4: platform_get_irq_byname() returns an int - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - i2c: s3c24xx: check the size of the SMBUS message before using it - nfc: llcp: add missing return after LLCP_CLOSED checks - drm/i915/psr: Do not use pipe_src as borders for SU area - objtool: Remove max symbol name length limitation - ALSA: usb-audio: Improve Focusrite sample rate filtering - gpio: tegra: fix irq_release_resources calling enable instead of disable - l2tp: Drop large packets with UDP encap - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - ipvs: fix NULL deref in ip_vs_add_service error path - selftests: net: bridge_vlan_mcast: wait for h1 before querier check - xsk: validate MTU against usable frame size on bind - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: respect tailroom for ZC setups - xsk: tighten UMEM headroom validation to account for tailroom and min frame - e1000: check return value of e1000_read_eeprom - dt-bindings: net: Fix Tegra234 MGBE PTP clock - net: stmmac: Fix PTP ref clock for Tegra234 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - eventpoll: defer struct eventpoll free to RCU grace period - drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - drm/vc4: Fix a memory leak in hang state error path - drm/vc4: Fix memory leak of BO array in hang state - drm/vc4: Release runtime PM reference after binding V3D - PCI: hv: Set default NUMA node to 0 for devices without affinity info - arm64: dts: imx8mq: Set the correct gpu_ahb clock frequency - soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - wifi: brcmfmac: validate bsscfg indices in IF events - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - HID: roccat: fix use-after-free in roccat_report_event - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - wifi: wl1251: validate packet IDs before indexing tx_frames - ALSA: hda/realtek: add quirk for Framework F111:000F - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - can: mcp251x: add error handling for power enable in open and resume - ASoC: SOF: topology: reject invalid vendor array size in token parser - ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - ALSA: asihpi: avoid write overflow check warning - media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - RDMA/irdma: Fix double free related to rereg_user_mr - Revert "PCI: Enable ACS after configuring IOMMU for OF platforms" - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: reject undecryptable rxkad response tickets - rxrpc: Only put the call ref if one was acquired - rxrpc: Fix key reference count leak from call->key - rxrpc: Fix call removal to use RCU safe deletion - net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() - net: stmmac: fix integer underflow in chain mode - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - net/mlx5: Update the list of the PCI supported devices - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - batman-adv: hold claim backbone gateways by reference - net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() - batman-adv: reject oversized global TT response buffers - nfc: pn533: allocate rx skb before consuming bytes - arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges - arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - wifi: brcmsmac: Fix dma_free_coherent() size - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN - MIPS: mm: Rewrite TLB uniquification for the hidden bit feature - MIPS: mm: Suppress TLB uniquification on EHINV hardware - MIPS: Always record SEGBITS in cpu_data.vmbits - Input: uinput - take event lock when submitting FF request "event" - mptcp: fix slab-use-after-free in __inet_lookup_established - net: rfkill: prevent unlimited numbers of rfkill events from being created - wifi: rt2x00usb: fix devres lifetime - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - MPTCP: fix lock class name family in pm_nl_create_listen_socket - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate() - x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - net: mana: fix use-after-free in add_adev() error path - net: macb: Move devm_{free,request}_irq() out of spin lock area - iio: imu: inv_icm42600: fix odr switch when turning buffer off - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - usb: gadget: f_uac1_legacy: validate control request size - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - btrfs: do not free data reservation in fallback from inline due to -ENOSPC - btrfs: fix the qgroup data free range for inline data extents - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - USB: dummy-hcd: Fix interrupt synchronization error - USB: dummy-hcd: Fix locking/synchronization error - thunderbolt: Fix property read in nhi_wake_supported() - misc: fastrpc: possible double-free of cctx->remote_heap - thermal: core: Fix thermal zone device registration error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - net: ftgmac100: fix ring allocation unwind on open failure - counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member - counter: rz-mtu3-cnt: prevent counter from being toggled multiple times - nvmem: imx: assign nvmem_cell_info::raw_len - dt-bindings: connector: add pd-disable dependency - comedi: me4000: Fix potential overrun of firmware buffer - comedi: me_daq: Fix potential overrun of firmware buffer - comedi: ni_atmio16d: Fix invalid clean-up after failed attach - comedi: Reinit dev->spinlock between attachments to low-level drivers - comedi: dt2815: add hardware detection to prevent crash - cdc-acm: new quirk for EPSON HMD - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: ehci-brcm: fix sleep during atomic - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: accel: fix ADXL355 temperature signature value - Input: xpad - add support for Razer Wolverine V3 Pro - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: synaptics-rmi4 - fix a locking bug in an error path - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/ast: dp501: Fix initialization of SCU2C - iio: adc: ti-adc161s626: fix buffer read on big-endian - mips: mm: Allocate tlb_vpn array atomically - hwmon: (occ) Fix division by zero in occ_show_power_1() - MIPS: Fix the GCC version check for `__multi3' workaround - ALSA: ctxfi: Fix missing SPDIFI1 index handling - ALSA: caiaq: fix stack out-of-bounds read in init_card - USB: serial: option: add MeiG Smart SRM825WN - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - riscv: kgdb: fix several debug register assignment bugs - mips: ralink: update CPU clock index - hwmon: (occ) Fix missing newline in occ_show_extended() - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (pxe1610) Check return value of page-select write in probe - accel/qaic: Handle DBC deactivation if the owner went away - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - net: hsr: fix VLAN add unwind on slave errors - net/x25: Fix overflow when accumulating packets - net/x25: Fix potential double free of skb - net/mlx5: Avoid "No data available" when FW version queries fail - net: macb: properly unregister fixed rate clocks - net: macb: fix clk handling on PCI glue driver removal - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - rds: ib: reject FRMR registration before IB connection is established - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec - NFC: pn533: bound the UART receive buffer - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - ipv6: prevent possible UaF in addrconf_permanent_addr() - ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure - tg3: Fix race for querying speed/duplex - net/ipv6: ioam6: prevent schema length wraparound in trace fill - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: fec: fix the PTP periodic output sysfs interface - crypto: caam - fix overflow on long hmac keys - crypto: caam - fix DMA corruption on long hmac keys - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation - wifi: ath11k: skip status ring entry processing - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - spi: geni-qcom: Check DMA interrupts early in ISR - btrfs: reject root items with drop_progress and zero drop_level - i2c: tegra: Don't mark devices with pins as IRQ safe - objtool: Fix Clang jump table detection - tg3: replace placeholder MAC address with device property - btrfs: don't take device_list_mutex when querying zone info - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - arm64/scs: Fix handling of advance_loc4 - Revert "rust: pin-init: add references to previously initialized fields" - Revert "rust: pin-init: internal: init: document load-bearing fact of field accessors" - dmaengine: idxd: Fix freeing the allocated ida too late - btrfs: fix lost error when running device stats on multiple devices fs - btrfs: fix super block offset in error message in btrfs_validate_super() - dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA - dmaengine: xilinx: xilinx_dma: Fix unmasked residue subtraction - dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA - dmaengine: xilinx: xilinx_dma: Fix dma_device directions - dmaengine: xilinx: xdma: Fix regmap init error handling - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - erofs: fix "BUG: Bad page state in z_erofs_do_read_page" - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - rust: pin-init: internal: init: document load-bearing fact of field accessors - rust: pin-init: add references to previously initialized fields - tracing: Fix potential deadlock in cpu hotplug with osnoise - tracing: Switch trace_osnoise.c code over to use guard() and __free() - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - powerpc64/bpf: do not increment tailcall count when prog is NULL - arm64: dts: imx8mn-tqma8mqnl: fix LDO5 power off - ext4: always drain queued discard work in ext4_mb_release() - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: fix the might_sleep() warnings in kvfree() - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: fix fsync(2) for nojournal mode - ext4: fix stale xarray tags after writeback - ext4: fix journal credit check when setting fscrypt context - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: stop reclaim before pushing AIL during unmount - LoongArch: Workaround LS2K/LS7A GPU DMA hang bug - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - dmaengine: sh: rz-dmac: Protect the driver specific lists - irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - jbd2: gracefully abort on checkpointing state corruptions - net: macb: Use dev_consume_skb_any() to free TX SKBs - scsi: ses: Handle positive SCSI error from ses_recv_diag() - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - alarmtimer: Fix argument order in alarm_timer_forward() - s390/entry: Scrub r12 register on kernel entry - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - KVM: arm64: Discard PC update state on vcpu reset - platform/x86: ISST: Correct locked bit width - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - ALSA: firewire-lib: fix uninitialized local variable - ksmbd: do not expire session on binding failure - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - s390/barrier: Make array_index_mask_nospec() __always_inline - s390/syscalls: Add spectre boundary for syscall dispatch table - spi: spi-fsl-lpspi: fix teardown order issue (UAF) - ASoC: adau1372: Fix clock leak on PLL lock failure - ASoC: adau1372: Fix unchecked clk_prepare_enable() return value - sysctl: fix uninitialized variable in proc_do_large_bitmap - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - ASoC: Intel: catpt: Fix the device initialization - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - PM: hibernate: Drain trailing zero pages on userspace restore - PM: hibernate: Don't ignore return from set_memory_ro() - drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - RDMA/irdma: Return EINVAL for invalid arp index error - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Initialize free_qp completion before using it - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - regmap: Synchronize cache for the page selector - Bluetooth: btusb: clamp SCO altsetting table indices - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: hci_sync: Remove remaining dependencies of hci_request - Bluetooth: Remove 3 repeated macro definitions - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - dma-mapping: add missing `inline` for `dma_free_attrs` - net: enetc: fix the output issue of 'ethtool --show-ring' - ice: use ice_update_eth_stats() for representor stats - platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - nfc: nci: fix circular locking dependency in nci_close_device - ionic: fix persistent MAC address override on PF - pinctrl: mediatek: common: Fix probe failure for devices without EINT - Bluetooth: hci_ll: Fix firmware leak on error path - can: statistics: add missing atomic access in hot path - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - xfrm: call xdo_dev_state_delete during state update - spi: intel-pci: Add support for Nova Lake mobile SPI flash - usb: core: new quirk to handle devices with zero configurations - objtool: Handle Clang RSP musical chairs - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - dma-buf: Include ioctl.h in UAPI header - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix event generation in fsl_easrc_iec958_set_reg() - HID: asus: add xg mobile 2023 external hardware support - HID: mcp2221: cancel last I2C command on read error - net: usb: r8152: add TRENDnet TUC-ET2G - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - nvme-pci: cap queue creation to used queues - platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - HID: asus: avoid memory leak in asus_report_fixup() - sh: platform_early: remove pdev->driver_override check - hwmon: (axi-fan-control) Use device firmware agnostic API - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - lib/bootconfig: check xbc_init_node() return in override path - ksmbd: fix use-after-free in durable v2 replay of active file handles - ksmbd: fix use-after-free of share_conf in compound request - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - mtd: rawnand: brcmnand: skip DMA during panic write - mtd: rawnand: serialize lock/unlock against other NAND operations - i2c: cp2615: fix serial string NULL-deref at probe - i2c: cp2615: replace deprecated strncpy with strscpy - i2c: pxa: defer reset on Armada 3700 when recovery is used - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - USB: serial: f81232: fix incomplete serial port generation - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - net: mvpp2: guard flow control update with global_tx_fc in buffer switching - netfilter: bpf: defer hook memory release until rcu readers are done - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net: macb: fix uninitialized rx_fs_lock - wifi: mac80211: fix NULL deref in mesh_matches_local() - iavf: fix VLAN filter lost on add/delete race - igc: fix missing update of skb->tail in igc_xmit_frame() - net: usb: aqc111: Do not perform PM inside suspend callback - sched: idle: Consolidate the handling of two special cases - net: bcmgenet: increase WoL poll timeout - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nft_ct: drop pending enqueued packets on removal - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - firmware: arm_scpi: Fix device_node reference leak in probe path - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - soc: fsl: qbman: fix race condition in qman_destroy_fq - cache: ax45mp: Fix device node reference leak in ax45mp_cache_init() - btrfs: tree-checker: fix misleading root drop_level error message - btrfs: log new dentries when logging parent dir of a conflicting inode - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/gmc9.0: add bounds checking for cid - serial: uartlite: fix PM runtime usage count underflow on probe - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: 8250_pci: add support for the AX99100 - iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - mtd: Avoid boot crash in RedBoot partition table parser - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: rawnand: pl353: make sure optimal timings are applied - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - mmc: sdhci: fix timing selection for 1-bit bus width - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - iio: light: bh1780: fix PM runtime leak on error path - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: fix transaction abort when snapshotting received subvolumes - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - kprobes: Remove unneeded goto - ksmbd: unset conn->binding on failed binding request - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - parisc: Flush correct cache in cacheflush() syscall - net: macb: fix use-after-free access to PTP clock - NFC: nxp-nci: allow GPIOs to sleep - LoongArch: Give more information if kmem access failed - s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - s390/stackleak: Fix __stackleak_poison() inline assembly constraint - s390/xor: Fix xor_xc_2() inline assembly constraints - mptcp: pm: in-kernel: always set ID as avail when rm endp - rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() - drm/amdgpu: Add basic validation for RAS header - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - btrfs: do not strictly require dirty metadata threshold for metadata writepages - rxrpc: Fix data-race warning and potential load/store tearing - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler - x86/sev: Harden #VC instruction emulation somewhat - dm-verity: disable recursive forward error correction - rxrpc: Fix recvmsg() unconditional requeue - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - btrfs: fix NULL dereference on root when tracing inode eviction - arm64: mm: Don't remap pgtables for allocate vs populate - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time - smb: client: Compare MACs in constant time - xfs: ensure dquot item is deleted from AIL only after log shutdown - xfs: fix integer overflow in bmap intent sort comparator - crypto: atmel-sha204a - Fix OOM ->tfm_count leak - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - drm/msm: Fix dma_free_attrs() buffer size - ksmbd: Don't log keys in SMB3 signing and encryption key generation - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - can: gs_usb: gs_can_open(): always configure bitrates before starting device - kbuild: Leave objtool binary around with 'make clean' - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL - x86/sev: Allow IBPB-on-Entry feature for SNP guests - platform/x86: hp-bioscfg: Support allocations of larger data - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - gve: defer interrupt enabling until NAPI registration - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - iio: imu: inv_icm42600: fix odr switch to the same value - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: buffer: Fix wait_queue not being removed - iio: chemical: bme680: Fix measurement wait duration calculation - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: dac: ds4424: reject -128 RAW value - btrfs: abort transaction on failure to update root in the received subvol ioctl - smb: client: fix iface port assignment in parse_server_interfaces - smb: client: fix in-place encryption corruption in SMB2_write() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - s390/dasd: Copy detected format information to secondary device - s390/dasd: Move quiesce state with pprc swap - xfs: fix undersized l_iclog_roundoff values - cifs: make default value of retrans as zero - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - drm/i915: Fix potential overflow of shmem scatterlist length - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - drm/amd: Set num IP blocks to 0 if discovery fails - drm/amdgpu: Fix use-after-free race in VM acquire - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: ncsi: fix skb leak in error paths - ksmbd: fix use-after-free by using call_rcu() for oplock_info - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - pmdomain: bcm: bcm2835-power: Fix broken reset status read - parisc: Check kernel mapping earlier at bootup - parisc: Fix initial page table creation for boot - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - parisc: Increase initial mapping to 64 MB with KALLSYMS - batman-adv: Avoid double-rtnl_lock ELP metric worker - tracing: Fix syscall events activation by ensuring refcount hits zero - ice: fix retry for AQ command 0x06EE - net: mana: Ring doorbell at 4 CQ wraparounds - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - ixgbevf: fix link setup issue - ice: reintroduce retry mechanism for indirect AQ - irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - device property: Allow secondary lookup in fwnode_get_next_child_node() - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - drm/bridge: samsung-dsim: Fix memory leak in error path - Revert "tcpm: allow looking for role_sw device in the main node" - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - libceph: admit message frames only in CEPH_CON_S_OPEN state - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: reject preamble if control segment is empty - tipc: fix divide-by-zero in tipc_sk_filter_connect() - ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - mmc: core: Avoid bitfield RMW for claim/retune flags - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/tracing: rss_stat: ensure curr is false from kthread context - usb: image: mdc800: kill download URB on timeout - usb: mdc800: handle signal and read racing - usb: renesas_usbhs: fix use-after-free in ISR during device removal - usb: roles: get usb role switch from parent only for usb-b-connector - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: yurex: fix race in probe - usb: xhci: Fix memory leak in xhci_disable_slot() - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: add QUIRK_NO_BOS for video capture several devices - KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - net: usb: lan78xx: skip LTM configuration for LAN7850 - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: fix silent drop of packets with checksum errors - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - cgroup: fix race between task migration and iteration - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - octeontx2-af: devlink health: use retained error fmsg API - octeontx2-af: devlink: fix NIX RAS reporter recovery condition - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - ASoC: detect empty DMI strings - ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - amd-xgbe: fix link status handling in xgbe_rx_adaptation - mctp: route: hold key->lock in mctp_flow_prepare_output() - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - mctp: i2c: fix skb memory leak in receive path - serial: caif: hold tty->link reference in ldisc_open and ser_release - net: sfp: improve Huawei MA5671a fixup - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - net: sfp: improve Nokia GPON sfp fixup - net: sfp: re-implement ignoring the hardware TX_FAULT signal - net/mlx5: IFC updates for disabled host PF - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/msm/dsi: Document DSC related pclk_rate and hdisplay calculations - net: dsa: realtek: rtl8365mb: remove ifOutDiscards from rx_packets - xprtrdma: Decrement re_receiving on the early exit paths - smb/server: Fix another refcount leak in smb2_open() - powerpc: 83xx: km83xx: Fix keymile vendor prefix - remoteproc: mediatek: Unprepare SCP clock during system suspend - remoteproc: sysmon: Correct subsys_name_len type in QMI request - powerpc/uaccess: Fix inline assembly for clang build on PPC32 - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - ASoC: cs42l43: Report insert for exotic peripherals - ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - scsi: ses: Fix devices attaching to different hosts - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - wifi: mac80211: set default WMM parameters on all links - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ACPI: PM: Save NVS memory on Lenovo G70-35 - net: tcp: accept old ack during closing - tracing: Add NULL pointer check to trigger_data_free() - selftest/arm64: Fix sve2p1_sigill() to hwcap test - i40e: use xdp.frame_sz as XDP RxQ info frag_size - i40e: fix registering XDP RxQ info - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: stmmac: Fix error handling in VLAN add and delete paths - nfc: rawsock: cancel tx_work before socket teardown - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: nci: free skb on nci_transceive early error paths - net: nfc: nci: Fix zero-length proprietary notifications - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - amd-xgbe: fix sleep while atomic on suspend/resume - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - net/rds: Fix circular locking dependency in rds_tcp_tune - indirect_call_wrapper: do not reevaluate function pointer - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: wlcore: Fix a locking bug - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep: Relocate counter updates before NAPI - net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value - kunit: tool: copy caller args in run_kernel to prevent mutation - rust: kunit: fix warning when !CONFIG_PRINTK - can: mcp251x: fix deadlock in error path of mcp251x_open - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - hwmon: (it87) Check the it87_lock() return value - platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - pinctrl: equilibrium: fix warning trace on load - pinctrl: equilibrium: rename irq_chip function callbacks - hwmon: (aht10) Fix initialization commands for AHT20 - hwmon: (aht10) Add support for dht20 - ARM: clean up the memset64() C wrapper - selftests: mptcp: join: check removing signal+subflow endp - selftests: mptcp: more stable simult_flows tests - smb: client: fix broken multichannel with krb5+signing - smb: client: fix cifs_pick_channel when channels are equally loaded - drbd: fix null-pointer dereference on local read error - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - net/sched: ets: fix divide by zero in the offload path - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: radiotap: reject radiotap with unknown bits - ALSA: usb-audio: Use correct version for UAC3 header validation - platform/x86: dell-wmi: Add audio/mic mute key codes - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - can: usb: f81604: handle bulk write errors properly - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - nfc: pn533: properly drop the usb interface reference on disconnect - eventpoll: Fix integer overflow in ep_loop_check_proc() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - drm/amd: Drop special case for yellow carp without discovery - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - usb: cdns3: remove redundant if branch - clk: tegra: tegra124-emc: fix device leak on set_rate() - arm64: dts: rockchip: Fix rk356x PCIe range mappings - mfd: omap-usb-host: Fix OF populate on driver rebind - mfd: omap-usb-host: Convert to platform remove callback returning void - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: qcom-pm8xxx: Convert to platform remove callback returning void - ext4: delete redundant calculations in ext4_mb_get_buddy_page_lock() - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - mailbox: Allow controller specific mapping using fwnode - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Use dev_err when there is error - mailbox: remove unused header files - mailbox: sort headers alphabetically - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: Use of_property_match_string() instead of open-coding - ext4: get rid of ppath in ext4_ext_create_new_leaf() - ext4: get rid of ppath in ext4_find_extent() - bus: omap-ocp2scp: fix OF populate on driver rebind - bus: omap-ocp2scp: Convert to platform remove callback returning void - drm/tegra: dsi: fix device leak on probe - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: tegra-video: Use accessors for pad config 'try_*' fields - KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - KVM: x86: Rename KVM_MSR_RET_INVALID to KVM_MSR_RET_UNSUPPORTED - PCI: Use resource_set_range() that correctly sets ->end - resource: Add resource set range and size helpers - PCI: Use resource names in PCI log messages - PCI: Update BAR # and window messages - memory: mtk-smi: fix device leak on larb probe - memory: mtk-smi: fix device leaks on common probe - memory: mtk-smi: Convert to platform remove callback returning void - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - btrfs: fix compat mask in error messages in btrfs_check_features() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: add support for inserting raid stripe extents - btrfs: read raid stripe tree from disk - btrfs: add raid stripe tree definitions - btrfs: move btrfs_extref_hash into inode-item.h - btrfs: remove btrfs_crc32c wrapper - btrfs: move btrfs_crc32c_final into free-space-cache.c - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: usb-audio: Use inclusive terms - ALSA: usb-audio: Cap the packet size pre-calculations - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - rseq: Clarify rseq registration rseq_size bound check comment - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - scsi: lpfc: Properly set WC for DPP mapping - irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" - arm64: Fix sampling the "stable" virtual counter in preemptible section - drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - NTB: ntb_transport: Fix too small buffer for debugfs_name - net: nfc: nci: Fix parameter validation for packet data - arm64: Force the use of CNTVCT_EL0 in __delay() - x86/kexec: Copy ACPI root pointer address from config table - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - fbcon: Remove struct fbcon_display.inverse - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - atm: fore200e: fix use-after-free in tasklets during device removal - net: intel: fix PCI device ID conflict between i40e and ipw2200 - io_uring/filetable: clamp alloc_hint to the configured alloc range - tracing: Fix to set write permission to per-cpu buffer_size_kb - octeontx2-af: CGX: fix bitmap leaks - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT - LoongArch: Prefer top-down allocation after arch_mem_init() - MIPS: rb532: Fix MMIO UART resource registration - staging: rtl8723bs: fix null dereference in find_network - parisc: kernel: replace kfree() with put_device() in create_tree_node() - PCI: Fix pci_slot_trylock() error handling - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - tipc: fix RCU dereference race in tipc_aead_users_dec() - mtd: rawnand: pl353: Fix software ECC support - usb: dwc2: fix resume failure if dr_mode is host - scsi: ufs: core: Flush exception handling work when RPM level is zero - perf/arm-cmn: Reject unsupported hardware configurations - remoteproc: imx_rproc: Fix invalid loaded resource table detection - btrfs: continue trimming remaining devices on failure - arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - ocfs2: fix reflink preserve cleanup issue - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - mm/highmem: fix __kmap_to_page() build error - iio: gyro: itg3200: Fix unchecked return value in read_raw - dm mpath: make pg_init_delay_msecs settable - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - nfsd: fix return error code for nfsd_map_name_to_[ug]id - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - xfs: fix remote xattr valuelblk check - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: delete attr leaf freemap entries when empty - mfd: core: Add locking around 'mfd_of_node_list' - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - media: verisilicon: AV1: Fix tile info buffer size - xfs: mark data structures corrupt on EIO and ENODATA - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - media: venus: vdec: fix error state assignment for zero bytesused - arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - dm-unstripe: fix mapping bug when there are multiple targets in a table - dm-integrity: fix recalculation in bitmap mode - s390/pci: Handle futile config accesses of disabled devices directly - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - media: i2c: ov01a10: Fix digital gain range - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - soc: ti: k3-socinfo: Fix regmap leak on probe failure - dm-integrity: fix a typo in the code for write/discard race - media: i2c: ov5647: use our own mutex for the ctrl lock - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Initialize subdev before controls - media: ccs: Avoid possible division by zero - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: i2c: ov01a10: Fix test-pattern disabling - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: radio-keene: fix memory leak in error path - media: verisilicon: AV1: Set IDR flag for intra_only frame type - arm64: dts: apple: t8112-j473: Keep the HDMI port powered on - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - HID: prodikeys: Check presence of pm->input_ep82 - HID: magicmouse: Do not crash on missing msc->input - HID: hid-pl: handle probe errors - arm64: Disable branch profiling for all arm64 code - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - ARM: omap2: Fix reference count leaks in omap_control_init() - media: verisilicon: AV1: Fix tx mode bit setting - media: verisilicon: AV1: Fix enable cdef computation - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: mtk-mdp: Fix error handling in probe function - media: mediatek: encoder: Fix uninitialized scalar variable issue - dm-verity: correctly handle dm_bufio_client_create() failure - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - ASoC: SOF: ipc4-control: Keep the payload size up to date - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - ASoC: SOF: ipc4-control: If there is no data do not send bytes update - clk: renesas: rzg2l: Select correct div round macro - clk: renesas: rzg2l: Fix intin variable size - rpmsg: core: fix race in driver_override_show() and use core helper - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5: DR, Fix circular locking dependency in dump - RDMA/umem: Fix double dma_buf_unpin in failure path - RDMA/efa: Fix typo in efa_alloc_mr() - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - tipc: fix duplicate publication key in tipc_service_insert_publ() - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - wifi: cfg80211: wext: fix IGTK key ID off-by-one - net: ethernet: xscale: Check for PTP support properly - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - ipmi: ipmb: initialise event handler read bytes - xfrm: skip templates check for packet offload tunnel mode - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - rtc: zynqmp: correct frequency value - drm/amd/display: Remove conditional for shaper 3DLUT power-on - btrfs: replace BUG() with error handling in __btrfs_balance() - ALSA: usb-audio: Add sanity check for OOB writes at silencing - drm/radeon: Add HAINAN clock adjustment - drm/amdgpu: Add HAINAN clock adjustment - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Adjust usleep_range in fence wait - drm/amd/display: Avoid updating surface with the same surface under MPO - ARM: 9467/1: mm: Don't use %pK through printk - include: uapi: netfilter_bridge.h: Cover for musl libc - thermal: int340x: Fix sysfs group leak on DLVR registration failure - ceph: supply snapshot context in ceph_uninline_data() - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: check return value of indx_find to avoid infinite loop - MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE - iio: magnetometer: Remove IRQF_ONESHOT - iio: Use IRQF_NO_THREAD - Revert "mfd: da9052-spi: Change read-mask to write-mask" - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - watchdog: imx7ulp_wdt: handle the nowayout option - binder: don't use %pK through printk - fix it87_wdt early reboot by reporting running timer - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - staging: rtl8723bs: fix memory leak on failure path - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - dmaengine: sun6i: Choose appropriate burst length under maxburst - fpga: of-fpga-region: Fail if any bridge is missing - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - serial: 8250_dw: handle clock enable errors in runtime_resume - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - m68k: nommu: fix memmove() with differently aligned src and dest for 68000 - clk: microchip: core: correct return value on *_get_parent() - mailbox: sprd: clear delivery flag before handling TX done - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: mask interrupts that are not handled - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - tracing: Fix false sharing in hwlat get_sample() - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: buslogic: Reduce stack usage - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - RDMA/rtrs-clt: For conn rejection use actual err number - myri10ge: avoid uninitialized variable use - PCI: Mark Nvidia GB10 to avoid bus reset - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Fix pci_slot_lock () device locking - net/rds: Clear reconnect pending bit - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net: usb: sr9700: remove code to drive nonexistent multicast filter - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - wifi: rtw89: pci: restore LDO setting after device resume - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - ipv4: fib: Annotate access to struct fib_alias.fa_state. - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - gro: change the BUG_ON() in gro_pull_from_frag0() - net/rds: No shortcut out of RDS_CONN_ERROR - wifi: iwlwifi: mvm: check the validity of noa_len - net: usb: r8152: fix transmit queue timeout - openrisc: define arch-specific version of nop() - netfilter: xt_tcpmss: check remaining length before reading optlen - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - ext4: mark group extend fast-commit ineligible - ext4: mark group add fast-commit ineligible - ipv6: exthdrs: annotate data-race over multiple sysctl - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - wifi: ath12k: fix preferred hardware mode calculation - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - iommu/amd: move wait_on_sem() out of spinlock - iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - dm: remove fake timeout to avoid leak request - dm: replace -EEXIST with -EBUSY - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - jfs: nlink overflow in jfs_rename - jfs: Add missing set_freezable() for freezable kthread - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - modpost: Amend ppc64 save/restfpr symnames for -Os build - ASoC: es8328: Add error unwind in resume - hwmon: (f71882fg) Add F81968 support - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - gpio: aspeed-sgpio: Change the macro to support deferred probe - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - HID: multitouch: add eGalaxTouch EXC3188 support - media: rkisp1: Fix filter mode register configuration - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - virt: vbox: uapi: Mark inner unions in packed structs as packed - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - media: v4l2-async: Fix error handling on steps after finding a match - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: solo6x10: Check for out of bounds chip_id - media: adv7180: fix frame interval in progressive mode - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: avoid a warning in timedout job handler - drm/amdgpu: add support for HDP IP version 6.1.1 - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - media: omap3isp: set initial format - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - drm/v3d: Set DMA segment size to avoid debug warnings - spi: stm32: fix Overrun issue at < 8bpw - media: dvb-core: dmxdevfilter must always flush bufs - spi-geni-qcom: use xfer->bits_per_word for can_dma() - spi-geni-qcom: initialize mode related registers to 0 - drm/display/dp_mst: Add protection against 0 vcpi - parisc: Prevent interrupts during reboot - arm64: tegra: smaug: Add usb-role-switch support - char: tpm: cr50: Remove IRQF_ONESHOT - mailbox: bcm-ferxrm-mailbox: Use default primary handler - PCI/MSI: Unmap MSI-X region on error - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - clocksource/drivers/sh_tmu: Always leave device running after probe - bpf: verifier improvement in 32bit shift sign extension pattern - sparc: don't reference obsolete termio struct for TC* constants - sparc: Synchronize user stack on fork and clone - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - xenbus: Use .freeze/.thaw to handle xenbus devices - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - s390/perf: Disable register readout on sampling events - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - md-cluster: fix NULL pointer dereference in process_metadata_update - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - EFI/CPER: don't go past the ARM processor CPER record buffer - x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - rnbd-srv: Zero the rsp buffer before using it - perf/arm-cmn: Support CMN-600AE - s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - tools/power cpupower: Reset errno before strtoull() - smb: client: add proper locking around ses->iface_last_update - btrfs: handle user interrupt properly in btrfs_trim_fs() - minix: Add required sanity checking to minix_check_superblock() - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - hfsplus: pretend special inodes as regular files - audit: add missing syscalls to read class - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - hfsplus: fix volume corruption issue for generic/498 - libperf build: Always place libperf includes first - libperf: Don't remove -g when EXTRA_CFLAGS are used - libsubcmd: Fix null intersection case in exclude_cmds() - perf callchain: Fix srcline printing with inlines - perf unwind-libdw: Fix invalid reference counts - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - ata: libata-scsi: refactor ata_scsi_translate() - ata: pata_ftide010: Fix some DMA timings - ext4: use optimized mballoc scanning regardless of inode format - ext4: don't cache extent during splitting extent - MIPS: Work around LLVM bug when gp is used as global register variable - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - x86/hyperv: Fix error pointer dereference - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - efi: Fix reservation of unaccepted memory table - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - spi: wpcm-fiu: Simplify with dev_err_probe() - spi: wpcm-fiu: Fix uninitialized res - spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amdkfd: fix debug watchpoints for logical devices - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/i915/acpi: free _DSM package when no connectors - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: provide separate audit messages for file and policy checks - apparmor: use passed in gfp flags in aa_alloc_null() - apparmor: fix rlimit for posix cpu timers - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix NULL sock in aa_sock_file_perm - net/mlx5: Fix multiport device check over light SFs - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - octeontx2-af: Fix default entries mcam entry action - cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) - cache: enforce cache groups - ping: annotate data-races in ping_lookup() - bpftool: Fix truncated netlink dumps - ipv6: fix a race in ip6_sock_set_v6only() - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled - selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled - net: bridge: mcast: always update mdb_n_entries for vlan contexts - net/rds: rds_sendmsg should not discard payload_len - net: usb: catc: enable basic endpoint checking - net: sparx5/lan969x: fix PTP clock max_adj value - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT - selftests/memfd: delete unused declarations - kbuild: Add objtool to top-level clean target - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - fs/ntfs3: prevent infinite loops caused by the next valid being the same - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - dmaengine: fsl-edma-main: Convert to platform remove callback returning void - backlight: qcom-wled: Change PM8950 WLED configurations - backlight: qcom-wled: Support ovp values for PMI8994 - leds: qcom-lpg: Check the return value of regmap_bulk_write() - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - iio: sca3000: Fix a resource leak in sca3000_probe() - ovl: Fix uninit-value in ovl_fill_real - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - usb: bdc: fix sleep during atomic - drivers: iio: mpu3050: use dev_err_probe for regulator request - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - coresight: etm3x: Fix cpulocked warning on cpuhp - watchdog: starfive-wdt: Fix PM reference leak in probe error path - iio: pressure: mprls0025pa: fix scan_type struct - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - serial: SH_SCI: improve "DMA support" prompt - serial: imx: change SERIAL_IMX_CONSOLE to bool - staging: greybus: lights: avoid NULL deref - dma: dma-axi-dmac: fix SW cyclic transfers - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - clk: mediatek: Fix error handling in runtime PM setup - clk: qcom: gfx3d: add parent to parent request map - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - tracing: Properly process error handling in event_hist_trigger_parse() - fs/nfs: Fix readdir slow-start regression - nvdimm: virtio_pmem: serialize flush requests - scsi: csiostor: Fix dereference of null pointer rn - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - mtd: spinand: Fix kernel doc - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - cxl: Fix premature commit_end increment on decoder commit failure - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - svcrdma: Reduce the number of rdma_rw contexts per-QP - svcrdma: Increase the per-transport rw_ctx count - svcrdma: Clean up comment in svc_rdma_accept() - svcrdma: Remove queue-shortening warnings - RDMA/core: Fix a couple of obvious typos in comments - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - crypto: ccp - Add an S4 restore flow - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/rtrs-srv: fix SG mapping - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: ab8500: Fix use-after-free in power_supply_changed() - IB/cache: update gid cache on client reregister event - RDMA/rtrs: server: remove dead code - octeontx2-pf: Unregister devlink on probe failure - ionic: Rate limit unknown xcvr type messages - serial: caif: fix use-after-free in caif_serial ldisc_close() - net: Add skb_dstref_steal and skb_dstref_restore - net: sunhme: Fix sbus regression - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - smb: client: correct value for smbd_max_fragmented_recv_size - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_hash: fix get operation on big endian - nfc: hci: shdlc: Stop timers and work before freeing context - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - bonding: only set speed/duplex to unknown, if getting speed failed - octeontx2-af: Fix PF driver crash with kexec kernel booting - mptcp: fix receive space timestamp initialization - of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - ipc: don't audit capability check in ipc_permissions() - PCI/ACPI: Restrict program_hpx_type2() to AER bits - PCI: Add defines for bridge window indexing - PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros - PCI: Log bridge info when first enumerating bridge - PCI: Log bridge windows conditionally - PCI: Supply bridge device, not secondary bus, to read window details - PCI: Move pci_read_bridge_windows() below individual window accessors - PCI: Initialize RCB from pci_configure_device() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - tcp: tcp_tx_timestamp() must look at the rtx queue - nfsd: never defer requests during idmap lookup - iommu/vt-d: Flush cache for PASID table before using it - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - module: add helper function for reading module_buildid() - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_tables: reset table validation state on abort - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - mctp i2c: initialise event handler read bytes - net: mctp-i2c: fix duplicate reception of old data - PCI/portdrv: Fix potential resource leak - PCI: Do not attempt to set ExtTag for VFs - Documentation: tracing: Add PCI tracepoint documentation - Documentation: trace: Refactor toctree - docs: fix WARNING document not included in any toctree - Documentation: tracing: Add ring-buffer mapping - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - PCI/PM: Avoid redundant delays on D3hot->D3cold - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - spi: tools: Add include folder to .gitignore - platform/chrome: cros_ec_lightbar: Fix response size initialization - media: uvcvideo: Fix allocation for small frame sizes - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - drm/msm/a2xx: fix pixel shader start on A225 - media: ccs: Accommodate C-PHY into the calculation - drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - HID: playstation: Add missing check for input_ff_create_memless - regulator: core: move supply check earlier in set_machine_constraints() - drm/msm/disp/dpu: add merge3d support for sc7280 - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - smack: /smack/doi: accept previously used values - smack: /smack/doi must be > 0 - workqueue: Process rescuer work items one-by-one using a cursor - workqueue: Only assign rescuer work when really needed - workqueue: Factor out assign_rescuer_work() - arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 - arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 - arm64: dts: amlogic: g12: assign the MMC A signal clock - arm64: dts: amlogic: g12: assign the MMC B and C signal clocks - arm64: dts: amlogic: gx: assign the MMC signal clocks - arm64: dts: amlogic: axg: assign the MMC signal clocks - arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node - ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells - powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - arm64: dts: qcom: sdm630: fix gpu_speed_bin size - clk: qcom: Return correct error code in qcom_cc_probe_by_index() - arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - soc: qcom: smem: handle ENOMEM error during probe - mfd: wm8350-core: Use IRQF_ONESHOT - EDAC/altera: Remove IRQF_ONESHOT - scsi: efct: Use IRQF_ONESHOT and default primary handler - hrtimer: Fix trace oddity - crypto: octeontx - fix dma_free_coherent() size - crypto: cavium - fix dma_free_coherent() size - ARM: VDSO: Patch out __vdso_clock_getres() if unavailable - libbpf: Fix OOB read in btf_dump_get_bitfield_value - selftests/bpf: veristat: fix printing order in output_stats() - crypto: qat - fix warning on adf_pfvf_pf_proto.c - s390/cio: Fix device lifecycle handling in css_alloc_subchannel() - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - perf: arm_spe: Properly set hw.state on failures - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - x86/xen: make some functions static - ublk: Validate SQE128 flag before accessing the cmd - iomap: fix submission side handling of completion side errors - md/raid10: fix any_working flag handling in raid10_sync_request - cpuidle: governors: menu: Always check timers with tick stopped - cpuidle: menu: Cleanup after loadavg removal - io_uring/sync: validate passed in offset - xen/virtio: Don't use grant-dma-ops when running as Dom0 - btrfs: fix block_group_tree dirty_list corruption - btrfs: qgroup: return correct error when deleting qgroup relation item - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - i3c: dw: Initialize spinlock to avoid upsetting lockdep - gfs2: Retries missing in gfs2_{rename,exchange} - i3c: master: Update hot-join flag only on success - fs: add <linux/init_task.h> for 'init_fs' - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() - rcu: s/boost_kthread_mutex/kthread_mutex - hfsplus: return error when node already exists in hfs_bnode_create - auxdisplay: arm-charlcd: fix release_mem_region() size - RDMA/siw: Fix potential NULL pointer dereference in header processing - !23322 iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - bpf: Avoid soft lockup in bpf_uprobe_unregister - !23394 Fix CVE-2026-45911 - !23321 iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23388 Fix CVE-2026-45982 - usb: cdns3: fix role switching during resume - urma: add v2p function in kernel for dfx such as urma_admin - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - !23392 Fix CVE-2026-46171 - !23176 Fix CVE-2026-46082 - !23277 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - !23376 ub: ub_fwctl: lift the restriction on querying the historical status of ports. - !22637 v3 io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - !22644 Fix CVE-2026-43366 - !23349 drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - !22645 Fix CVE-2026-43288 - !23348 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !22714 Fix CVE-2026-43163 - !22610 Fix CVE-2026-43061 - !23361 CVE-2026-46181 - !23177 ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - !23317 add min_slice and sched_runtime - !23373 drivers/ub/sentry: enhance sentry module error handling and logging observability - !23309 ub: ubase: Correct the statistics on ELR reset failures - urma: increase topo max node limit to 1024 - ub: ub_fwctl: the function of querying the historical status of ports has been unrestricted. - drivers/ub/sentry: enhance sentry module error handling and logging observability - riscv: kvm: fix vector context allocation leak - !23094 urma: fix jetty_grp count boundary check and pass opt_mask to urma_check_opt_valid - !23288 Fix CVE-2026-46093 - !23294 Fix CVE-2026-43406 - ub:hisi-ubus: modify return value of hi_feature_get() in abnormal branch - urma: fix jetty_grp count boundary check and pass opt_mask to check_jetty_check_dev_cap - APEI/GHES: ARM processor Error: don't go past allocated memory - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() - refcount: provide ops for cases when object's memory can be reused - !23316 sched/cputime: Fix time overflow in cputime_adjust() - !23346 ub: udma: change default value of set dev name - !23341 soc: hisilicon: kunpeng_hccs: Remove unused input parameter - !23330 Fix CVE-2026-46165 - !23326 Fix CVE-2026-43466 - !23328 Fix CVE-2026-46033 - !23325 Fix CVE-2026-43468 - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - iommu/ummu: Fix reading command value in check_pa_continuity_nop_exec - !23125 Fix CVE-2026-46051 - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - !23188 CVE-2026-46044 - ub: udma: change default value of set dev name - soc: hisilicon: kunpeng_hccs: Remove unused input parameter - soc: hisilicon: kunpeng_hccs: Fix discard 'const' qualifier - !23028 bugfixs for sched_ext - !22886 net: yt6801: fix link info for yt6801 - !23290 iommu/amd: serialize sequence allocation under concurrent TLB invalidations - openvswitch: vport: fix self-deadlock on release of tunnel ports - crypto: authencesn - reject short ahash digests during instance creation - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/mlx5: Fix deadlock between devlink lock and esw->wq - iommu/ummu: Fix potential soft lockup in ummu_core_alloc_separate_tdev - iommu/ummu: Fix incorrect xarray index in map_pages error path - sched/eevdf: Force propagating min_slice of cfs_rq when {en,de}queue tasks - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash - sched: Fix kabi breakage in struct sched_entity - sched/eevdf: Propagate min_slice up the cgroup hierarchy - sched/fair: Re-organize dequeue_task_fair() - sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion - sched/cputime: Fix time overflow in cputime_adjust() - libceph: prevent potential out-of-bounds reads in process_message_header() - iommu/amd: serialize sequence allocation under concurrent TLB invalidations - mm/vmalloc: take vmap_purge_lock in shrinker - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - obmm: validate VMA identity via vm_ops before accessing vm_file - obmm: add PMD huge entry support for ptrace/GDB vma access - obmm: fix VMA access for ptrace/GDB on export regions - obmm: fix page table walk for ownership permission updates - obmm: reject MAP_PRIVATE - md/raid5: fix soft lockup in retry_aligned_read() - ipmi:ssif: NULL thread on error - ipmi:ssif: Clean up kthread on errors - ub: ubase: Correct the statistics on ELR reset failures - ub: ubase&unic: Improve driver code readability - ub: ubase: Discard ctrlq request with non-zero ret value - ub: ubase: Add abort handling for non-timeout ELR failures - net: unic: Log rectification for the wildfire project - ub: ubase/unic/cdma: Clear adev_status when probe succeeds - net: unic: Filter out IPv6 link-local address in bond IP notification - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next - sched_ext: fix flag check for deferred callbacks - sched_ext: defer queue_balance_callback() until after ops.dispatch - sched_ext: Keep bypass on between enable failure and scx_disable_workfn() - urma: fix RNR ERR under CTP mode in IPoURMA - net: yt6801: fix link info for yt6801 - md/bitmap: fix GPF in write_page caused by resize race - ext4: move ext4_percpu_param_init() before ext4_mb_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - io_uring: validate user-controlled cq.head in io_cqe_cache_refill() - serial: 8250: Fix TX deadlock when using DMA - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - update kernel version to openEuler 6.6.0-28.0.0 - update kernel version to openEuler 6.6.0-53.0.0 - update Raspberry Pi patch, last commit (ff0fe12ab875d587348b6f2b9e73ae928049ebee): dtoverlay: Add a dtoverlay for pwm-gpio - fix: initial output, then the screen goes black - add support for RPi 5 - update kernel version to openEuler 6.6.0-59.0.0 - update kernel version to openEuler 6.6.0-66.0.0 - update kernel version to openEuler 6.6.0-68.0.0 - update kernel version to openEuler 6.6.0-72.0.0 - update kernel version to openEuler 6.6.0-75.0.0 - iommu: Hook up '->unmap_pages' driver callback - update kernel version to openEuler 6.6.0-84.0.0 - update Raspberry Pi patch, last commit (f1076a9d7a269d72b6707283560d0d38203cb07a): delete the comment - add sub package: raspberrypi-kernel-headers - fix file erros in raspberrypi-kernel-develchangel - upgrade to 6.6.0-152.0.0 - update kernel version to openEuler 6.6.0-28.0.0 - update kernel version to openEuler 6.6.0-53.0.0 - update Raspberry Pi patch, last commit (ff0fe12ab875d587348b6f2b9e73ae928049ebee): dtoverlay: Add a dtoverlay for pwm-gpio - fix: initial output, then the screen goes black - add support for RPi 5 - update kernel version to openEuler 6.6.0-59.0.0 - update kernel version to openEuler 6.6.0-66.0.0 - update kernel version to openEuler 6.6.0-68.0.0 - update kernel version to openEuler 6.6.0-72.0.0 - update kernel version to openEuler 6.6.0-75.0.0 - iommu: Hook up '->unmap_pages' driver callback - update kernel version to openEuler 6.6.0-84.0.0 - update Raspberry Pi patch, last commit (f1076a9d7a269d72b6707283560d0d38203cb07a): delete the comment - add sub package: raspberrypi-kernel-headers - fix file erros in raspberrypi-kernel-develchangel - upgrade to 6.6.0-152.0.0 - update kernel version to openEuler 6.6.0-28.0.0 - update kernel version to openEuler 6.6.0-53.0.0 - update Raspberry Pi patch, last commit (ff0fe12ab875d587348b6f2b9e73ae928049ebee): dtoverlay: Add a dtoverlay for pwm-gpio - fix: initial output, then the screen goes black - add support for RPi 5 - update kernel version to openEuler 6.6.0-59.0.0 - update kernel version to openEuler 6.6.0-66.0.0 - update kernel version to openEuler 6.6.0-68.0.0 - update kernel version to openEuler 6.6.0-72.0.0 - update kernel version to openEuler 6.6.0-75.0.0 - iommu: Hook up '->unmap_pages' driver callback - update kernel version to openEuler 6.6.0-84.0.0 - update Raspberry Pi patch, last commit (f1076a9d7a269d72b6707283560d0d38203cb07a): delete the comment - add sub package: raspberrypi-kernel-headers - fix file erros in raspberrypi-kernel-develchangel - upgrade to 6.6.0-152.0.0 - update kernel version to openEuler 6.6.0-28.0.0 - update kernel version to openEuler 6.6.0-53.0.0 - update Raspberry Pi patch, last commit (ff0fe12ab875d587348b6f2b9e73ae928049ebee): dtoverlay: Add a dtoverlay for pwm-gpio - fix: initial output, then the screen goes black - add support for RPi 5 - update kernel version to openEuler 6.6.0-59.0.0 - update kernel version to openEuler 6.6.0-66.0.0 - update kernel version to openEuler 6.6.0-68.0.0 - update kernel version to openEuler 6.6.0-72.0.0 - update kernel version to openEuler 6.6.0-75.0.0 - iommu: Hook up '->unmap_pages' driver callback - update kernel version to openEuler 6.6.0-84.0.0 - update Raspberry Pi patch, last commit (f1076a9d7a269d72b6707283560d0d38203cb07a): delete the comment - add sub package: raspberrypi-kernel-headers - fix file erros in raspberrypi-kernel-develchangel - upgrade to 6.6.0-152.0.0