- update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - update kernel-rt version to 6.6.0-53.0.0.5 - update kernel-rt version to 6.6.0-59.0.0.6 - update kernel-rt version to 6.6.0-62.0.0.7 - update kernel-rt version to 6.6.0-79.0.0.8 - update kernel-rt version to 6.6.0-154.0.0.9 - !23400 [OLK-6.6] ub: ubase & net: unic: 5 bugfixes - !23237 Fix CVE-2026-45917 - !22921 [OLK-6.6] Fix CVE-2026-23361 - !22672 [OLK-6.6] Fix CVE-2026-23262 - !22639 [OLK-6.6] Fix CVE-2026-23239 - !22332 [OLK-6.6] Fix CVE-2026-23214 - !22350 [OLK-6.6] Fix CVE-2026-23213 - !20711 [OLK-6.6] Fix CVE-2025-71109 - !23499 RDMA/hns: Fix log flood after cmd_mbox failure - !23530 CVEs - !23509 x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - !22587 urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - urma: Fix the issue where functions such as uburma_cmd_unimport_seg() cannot measure running time - !23500 fix CVE-2026-45893 - !23424 Fix HWPSIRT-2026-70484 - !23484 urma: fix uburma ioctl error handling for connection - !23048 Fix CVE-2026-43101 - hwrng: core - use RCU and work_struct to fix race condition - hwrng: core - Allow runtime disabling of the HW RNG - RDMA/mlx5: Fix UMR hang in LAG error state unload - x86/cpu/hygon: Fix node ID overflow for Hygon models 0x4-0x8 - apparmor: Fix & Optimize table creation from possibly unaligned memory - AppArmor: Allow apparmor to handle unaligned dfa tables - xfrm: esp: restore combined single-frag length gate - urma: fix uburma ioctl error handling for connection - RDMA/hns: Fix log flood after cmd_mbox failure - ipvs: do not keep dest_dst if dev is going down - net: ioam6: fix OOB and missing lock - ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() - net: unic: Fix the issue of system suspend when the fe - ub: ubase: Resolved the issue of printing logs in spin - ub: ubase: Ctrlq code optimization - net: unic: Added logging related to the Jetty context - ub: ubase: Adjust the macro definition for querying chip - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - gve: Fix stats report corruption on queue count change - espintcp: Fix race condition in espintcp_close() - btrfs: reject new transactions if the fs is fully read-only - drm/amdgpu: ensure no_hw_access is visible before MMIO - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits - !23227 Fix CVE-2026-45850 - !23672 drm/amd/display: Fix dc_link NULL handling in HPD init - !23537 Fix CVE-2026-31709 - !23520 Fix CVE-2026-46242 - !23370 mm/page_alloc: clear page->private in free_pages_prepare() - !23689 KVM: SVM: Add missing save/restore handling of LBR MSRs - !23687 urma: fix unimport jetty function call and remove debug logs - !23606 Fix CVE-2026-43216 - !23669 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - KVM: SVM: Add missing save/restore handling of LBR MSRs - urma: fix unimport jetty function call and remove debug logs - !23417 Fix CVE-2026-43059 - !23676 v2 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23402 mm: fix CMA folio mempolicy and migration - drm/amd/display: Fix dc_link NULL handling in HPD init - KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT - !23653 urma: bugfix of lru_node and rt_work in wk0 req/resp - !23636 urma: fix well-known jetty create/delete hook up with main ue eid event - !23428 dlm: validate length in dlm_search_rsb_tree - !23654 mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: enhance the reliability of the kernel-mode wk_jetty retransmission - mm/vmscan: fix wrong callback in shrinker_v2_to_v1_scan_objects() - urma: fix well-known jetty create/delete hook up with main ue eid event - mm: fix CMA folio migration problems - mm: enhance CMA folio mempolicy support and fix MPOL_BIND bypass - net: Drop the lock in skb_may_tx_timestamp() - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - smb: client: validate the whole DACL before rewriting it in cifsacl - eventpoll: fix ep_remove struct eventpoll / struct file UAF - eventpoll: move epi_fget() up - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: kill __ep_remove() - eventpoll: split __ep_remove() - eventpoll: use hlist_is_singular_node() in __ep_remove() - dlm: validate length in dlm_search_rsb_tree - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - mm/page_alloc: clear page->private in free_pages_prepare() - ipvs: skip ipv6 extension headers for csum checks - !23518 x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - !23750 irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - !23743 urma: remove the redundant update of the tx_ring in error branch - !23738 virtcca huk-based data key interface - !22962 Fix CVE-2026-43089 - !22990 netfilter: ctnetlink: ensure safe access to master conntrack - virtcca huk-based key encryption - !23686 CVE-2026-46065 - irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support - Revert "irqchip/gic-v3: Fix ALLINT masking logic by decoupling from GIC NMI support" - !23477 xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - !23728 iommu/vt-d: Clear Present bit before tearing down PASID entry - urma: remove the redundant update of the tx_ring in error branch - !23700 Fix PMD sharing disabled by missing SPLIT_PMD_PTLOCKS - !23632 Fix CVE-2026-43465 - !23688 urma: fix cm payload and async bind callback - !23701 spi: spidev: fix lock inversion between spi_lock and buf_lock - !23692 ub: udma: modify the UDMA document. - !23667 udma: optimizing the scheme for separating page - !23712 Fix CVE-2026-43198 - !23722 8021q: use RCU for egress QoS mappings - !23412 Fix CVE-2026-43088 - !23706 vhost: move vdpa group bound check to vhost_vdpa - iommu/vt-d: Clear Present bit before tearing down PASID entry - 8021q: delete cleared egress QoS mappings - 8021q: use RCU for egress QoS mappings - tcp: restore kABI for syn_recv_sock() backport - !23419 Fix CVE-2026-43073 - vhost: move vdpa group bound check to vhost_vdpa - spi: spidev: fix lock inversion between spi_lock and buf_lock - mm: make SPLIT_PTE_PTLOCKS depend on SMP - powerpc/8xx: document and enforce that split PT locks are not used - mm: turn USE_SPLIT_PTE_PTLOCKS / USE_SPLIT_PTE_PTLOCKS into Kconfig options - ub: udma: modify the UDMA document. - ub: udma: optimizing the scheme for separating page - urma: fix cm payload and async bind callback - fbdev: defio: Remove unused variable 'fbdefio' to fix build warning - fbdev: defio: fix KABI breakage in struct fb_deferred_io and struct fb_info - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fbdev/deferred-io: Always call get_page() for framebuffer pages - fbdev/deferred-io: Clean up pageref on lastclose - x86/cpu/hygon: Adjust the die_id and logical_die_id for Hygon models 0x4-0x8 - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - tcp: fix potential race in tcp_v6_syn_recv_sock() - xfs: fix possible bugon in xfs_trans_unreserve_and_mod_sb() - x86-64: rename misleadingly named '__copy_user_nocache()' function - net: af_key: zero aligned sockaddr tail in PF_KEY exports - netfilter: ctnetlink: ensure safe access to master conntrack - xfrm_user: fix info leak in build_mapping() - !23816 netfilter: x_tables: ensure names are nul-terminated - !23812 bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - netfilter: x_tables: ensure names are nul-terminated - !23804 mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - !23323 iommu/ummu: Enable separated SVA page table by default - bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs - !22670 [OLK-6.6] Fix CVE-2026-31607 - !22632 [OLK-6.6] Fix CVE-2026-31606 - !23792 urma: fix dev cap struct length by reserved - !23725 urma: publish ipourma eid after setup - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - urma: fix dev cap struct length by reserved - !23769 ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !23787 crypto: hisilicon - add backlog support - !23772 ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23753 iommu/vt-d: Clear Present bit before tearing down context entry - ub:ubus: Fix the calculation of the total_ues for MUE in VDM registration - !22947 Fix CVE-2026-43024 - !22884 Fix CVE-2026-43107 - !23742 LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - !23690 mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - !23634 backport cpufreq patches from linux mainline. - crypto: hisilicon/hpre: implement full backlog support for hpre driver - crypto: hisilicon/sec2 - restore iv for ctr mode - crypto: hisilicon/sec2 - fix resource leakage issues in non-backlog mode - crypto: hisilicon/sec2 - fix UAF in sec_alg_send_backlog - crypto: hisilicon/zip - add backlog support for zip - !22664 update rnpgbe driver to version 1.0.10 - !23651 cpufreq: Documentation: fix sampling_down_factor documentation range - !23764 Fix livepatch and kretprobe conflict warning - !23763 virtcca inclusion: add msk_encrypted field - ub:ubus: Using activate mutex to prevent reset and activate/deactivate occuring concurrently - !23760 Fix CVE-2026-46243 - bug fix for virtcca huk-based key encryption - rethook: Use tsk->on_cpu to check task execution state - rethook: Remove warning messages printed for finding return address of a frame. - smb: client: reject userspace cifs.spnego descriptions - urma: fix ipourma eid setup ordering - iommu/vt-d: Clear Present bit before tearing down context entry - drivers/iommu: Revise IOMMU memory reservation interface call timing - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt preempt feature in hypervisor side" - LoongArch: KVM: Revert "LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side" - LoongArch: KVM: Revert "LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function" - mm/filemap: fix filemap_alloc_folio_local() return NULL with GFP_NOFAIL - cpufreq: Documentation: fix freq_step description - cpufreq: Documentation: fix sampling_down_factor documentation range - cpufreq: conservative: Simplify frequency limit handling - cpufreq: Avoid redundant target() calls for unchanged limits - cpufreq: Fix typo in comment - arm64: smp: Do not mark secondary CPUs possible under nosmp - iommu/ummu: Enable separated SVA page table by default - rnpgbe: update rnpgbe driver to version 1.0.10 - netfilter: nf_tables: reject immediate NF_QUEUE verdict - xfrm: account XFRMA_IF_ID in aevent size calculation - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: gadget: f_hid: don't call cdev_init while cdev in use - The RISC-V kernel patch upgrade to 6.6.0-157.0.0 For more details, refer to the rvck-olk repository. - !23864 urma: add command to query TP information - !23849 iommu/ummu: Fix TLB invalidation flow in map/unmap - !23859 ub: cdma: refactor naming conventions and code cleanup - !23865 drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - !23814 ub:ubus: Eliminate some compilation warnings on the code review platform - urma: add command to query TP information - !23863 urma: fix target_reuse_tpid connect waiting times - urma: fix target_reuse_tpid connect waiting times - drivers/ub/sentry: fix memory leak and use-after-free in smh_message_get() - vfio:ubus: Corrected the English errors of vfio - ub:ubfi: Corrected the English errors of ubfi - ub:ubus: Corrected the English errors of ubus - ub:ubus: add module_version for udev modules - ub:ubus: Eliminate some compilation warnings on the code review platform - !23554 Add Hygon NB driver support and update the interface used by other driver - ub: cdma: refactor naming conventions and code cleanup - !23838 urma: fix tpid reuse start up link error and ref cnt - urma: fix tpid reuse start up link error and ref cnt - iommu/ummu: Fix TLB invalidation flow in map/unmap - !23212 urma: add eid sharing mode - urma: add eid sharing mode - !23832 ub: cdma: fix some code errors detected by AI in the kernel cdma - !23773 obmm: fix vma access check for PROT_WRITE-only mappings - obmm: fix vma access check for PROT_WRITE-only mappings - !23762 urma: change the enum in ubcore_cmd.h for netlink msg_type - !23813 netconsole: avoid OOB reads, msg is not nul-terminated - ub: cdma: fix some code errors detected by AI in the kernel cdma - !23829 CVE-2026-31588 - !23799 scsi/hiraid: Support new RAID features and bug fixes - !23828 RDMA/hns: Return actual error code instead of fixed EINVAL - !23724 urma: validate ubcore message version for compatibility - !23765 【OLK-6.6】urma: fix panic issue when ifconfig up/down ipourma device - fix "KVM: x86: Use scratch field in MMIO fragment to hold small write values" KABI CRC break issue - KVM: x86: Use scratch field in MMIO fragment to hold small write values - RDMA/hns: Return actual error code instead of fixed EINVAL - RDMA/hns: Fix RoCEv1 failure due to DSCP - urma: validate ubcore message version for compatibility - netconsole: avoid OOB reads, msg is not nul-terminated - scsi/hiraid: Support new RAID features and bug fixes - urma: change the enum in ubcore_cmd.h for netlink msg_type - urma: fix panic issue when ifconfig up/down ipourma device - EDAC/amd64:Update the SMN and nb interface used by Hygon processors in EDAC - hwmon/k10temp: Update the SMN interface used by Hygon processors in k10temp - x86/hygon_nb: Add Hygon Northbridge driver support via PCI enumeration - LoongArch: rename packaged EFI kernel image to avoid auto boot entry generation - !23899 ub:ubus: Resolve the issue of msgq consuming CPU resources - !23893 netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23839 xfrm: Fix CVE-2026-43091 RCU use-after-free in policy netns exit - !23822 bpf: Fix bpf_xdp_store_bytes proto for read-only arg - !23855 ub:udma:fix the bug in the eid update process. - !23867 urma: add set_share_topo host EID programming path - !23845 [OLK-6.6][linux-6.6.y sync] Backport 6.6.127-6.6.128 LTS conflict Patches-p1 - urma: add set_share_topo host EID programming path - ub: udma: fix the bug in the eid update process. - ub:ubus: Resolve the issue of msgq consuming CPU resources - !23640 [OLK-6.6] Fix CVE-2026-46103 - !23333 ntfs3: fix circular locking dependency in run_unpack_ex - !23347 ksmbd: close durable scavenger races against m_fp_list lookups - !23719 [OLK-6.6] Fix CVE-2026-31580 - !23630 [OLK-6.6] Fix CVE-2026-31725 - !20853 [OLK-6.6] Fix CVE-2025-39932 - !23611 [OLK-6.6] Fix CVE-2026-43295 - !23604 [OLK-6.6] Fix CVE-2026-43296 - !23315 [OLK-6.6] Fix CVE-2025-71272 - !23588 net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - !22397 [OLK-6.6] Fix CVE-2025-71203 - !23713 ubcore: Add host info lookup trie for CTP reuse - !23844 urma: add dfx for ns mode - !23882 ub: udma: resolve the issue of false verification. - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - !23875 ub:ubus: Add new chip information into ubus_error_table - !23874 CVE-2026-46322 - ub: udma: resolve the issue of false verification. - !23868 [OLK-6.6] ub: ubase: 5 related changes - ub:ubus: Add new chip information into ubus_error_table - ub:ubus: ras adapter of the new chips - urma: Add host info lookup trie for CTP reuse - urma: add dfx for ns mode - tun: free page on build_skb failure in tun_xdp_one() - !23869 ub: udma: resolve issues of create ccu_jetty. - ub: udma: resolve issues of create ccu_jetty. - ub: udma: set the jetty type by id - ASoC: nau8821: Cancel delayed work on component remove - ASoC: nau8821: Cancel pending work before suspend - octeon_ep: initialise control mbox tasks before using APIs - octeon_ep: ensure dbell BADDR updation - octeon_ep: set backpressure watermark for RX queues - octeon_ep: disable per ring interrupts - octeon_ep: support Octeon CN10K devices - octeon_ep: restructured interrupt handlers - octeon_ep: support to fetch firmware info - ASoC: nau8821: Fixup nau8821_enable_jack_detect() - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - ASoC: nau8821: Consistently clear interrupts before unmasking - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - bpf, sockmap: Fix incorrect copied_seq calculation - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - xfrm: Wait for RCU readers during policy netns exit - most: core: fix leak on early registration failure - most: core: fix resource leak in most_register_interface error paths - most: remove usage of the deprecated ida_simple_xx() API - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - MAINTAINERS: remove Jerin Jacob from Marvell OcteonTX2 - bcache: fix uninitialized closure object - bcache: fix cached_dev.sb_bio use-after-free and crash - can: ucan: fix devres lifetime - ksmbd: close durable scavenger races against m_fp_list lookups - ksmbd: validate owner of durable handle on reconnect - ksmbd: add durable scavenger timer - ksmbd: avoid reclaiming expired durable opens by the client - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - ntfs3: fix circular locking dependency in run_unpack_ex - net: unic: Fix JFC context domain segment fields and - net: unic: Add statistics on abnormal cqe - ub:ubase:anti-attack feature adaptation - ub: ubase: Add execution statistics for the software - ub: ubase: Add retry when ctrlq e2e msg send fail during - riscv: Sanitize syscall table indexing under speculation - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - !23911 iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - !23906 [OLK-6.6] ub: ubase & unic: 6 related fixes - !23910 iommu/ummu: Fix null pointer problem during permission table expansion - iommu/ummu: Fix the UB_UMMU_BYPASSEID dependency error - iommu/ummu: Fix null pointer problem during permission table expansion - ub: ubase: optimize activate dev request handling in - ub: ubase: process change for querying SL through the - ub: ubase: set the delay processing time for ctrlq crq to - net: unic: resolve environment panic caused by alloc page - ub: ubase: increase reset task scheduling delay to avoid - ub: ubase: adapt to the API of alloc memory of ummu - !23924 [OLK-6.6] ub: unic: separate DSCP-TC and prio-TC mapping configuration - !23907 urma: fix log error print wrong place - !23914 ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23923 urma: refactor ubagg connect and message handling - urma: refactor ubagg connect and message handling - ub: ub_fwctl: Modify the method of obtaining link status in the port_link command. - !23696 urma: enable shared-CTP - urma: ubcore enable shared-ctp - urma: fix log error print wrong place - ub: unic: separate DSCP-TC and prio-TC mapping configuration - update kernel version to openEuler 6.6.0-28.0.0 - update kernel version to openEuler 6.6.0-53.0.0 - update Raspberry Pi patch, last commit (ff0fe12ab875d587348b6f2b9e73ae928049ebee): dtoverlay: Add a dtoverlay for pwm-gpio - fix: initial output, then the screen goes black - add support for RPi 5 - update kernel version to openEuler 6.6.0-59.0.0 - update kernel version to openEuler 6.6.0-66.0.0 - update kernel version to openEuler 6.6.0-68.0.0 - update kernel version to openEuler 6.6.0-72.0.0 - update kernel version to openEuler 6.6.0-75.0.0 - iommu: Hook up '->unmap_pages' driver callback - update kernel version to openEuler 6.6.0-84.0.0 - update Raspberry Pi patch, last commit (f1076a9d7a269d72b6707283560d0d38203cb07a): delete the comment - add sub package: raspberrypi-kernel-headers - fix file erros in raspberrypi-kernel-develchangel - upgrade to 6.6.0-152.0.0 - update kernel version to openEuler 6.6.0-28.0.0 - update kernel version to openEuler 6.6.0-53.0.0 - update Raspberry Pi patch, last commit (ff0fe12ab875d587348b6f2b9e73ae928049ebee): dtoverlay: Add a dtoverlay for pwm-gpio - fix: initial output, then the screen goes black - add support for RPi 5 - update kernel version to openEuler 6.6.0-59.0.0 - update kernel version to openEuler 6.6.0-66.0.0 - update kernel version to openEuler 6.6.0-68.0.0 - update kernel version to openEuler 6.6.0-72.0.0 - update kernel version to openEuler 6.6.0-75.0.0 - iommu: Hook up '->unmap_pages' driver callback - update kernel version to openEuler 6.6.0-84.0.0 - update Raspberry Pi patch, last commit (f1076a9d7a269d72b6707283560d0d38203cb07a): delete the comment - add sub package: raspberrypi-kernel-headers - fix file erros in raspberrypi-kernel-develchangel - upgrade to 6.6.0-152.0.0 - update kernel version to openEuler 6.6.0-28.0.0 - update kernel version to openEuler 6.6.0-53.0.0 - update Raspberry Pi patch, last commit (ff0fe12ab875d587348b6f2b9e73ae928049ebee): dtoverlay: Add a dtoverlay for pwm-gpio - fix: initial output, then the screen goes black - add support for RPi 5 - update kernel version to openEuler 6.6.0-59.0.0 - update kernel version to openEuler 6.6.0-66.0.0 - update kernel version to openEuler 6.6.0-68.0.0 - update kernel version to openEuler 6.6.0-72.0.0 - update kernel version to openEuler 6.6.0-75.0.0 - iommu: Hook up '->unmap_pages' driver callback - update kernel version to openEuler 6.6.0-84.0.0 - update Raspberry Pi patch, last commit (f1076a9d7a269d72b6707283560d0d38203cb07a): delete the comment - add sub package: raspberrypi-kernel-headers - fix file erros in raspberrypi-kernel-develchangel - upgrade to 6.6.0-152.0.0 - update kernel version to openEuler 6.6.0-28.0.0 - update kernel version to openEuler 6.6.0-53.0.0 - update Raspberry Pi patch, last commit (ff0fe12ab875d587348b6f2b9e73ae928049ebee): dtoverlay: Add a dtoverlay for pwm-gpio - fix: initial output, then the screen goes black - add support for RPi 5 - update kernel version to openEuler 6.6.0-59.0.0 - update kernel version to openEuler 6.6.0-66.0.0 - update kernel version to openEuler 6.6.0-68.0.0 - update kernel version to openEuler 6.6.0-72.0.0 - update kernel version to openEuler 6.6.0-75.0.0 - iommu: Hook up '->unmap_pages' driver callback - update kernel version to openEuler 6.6.0-84.0.0 - update Raspberry Pi patch, last commit (f1076a9d7a269d72b6707283560d0d38203cb07a): delete the comment - add sub package: raspberrypi-kernel-headers - fix file erros in raspberrypi-kernel-develchangel - upgrade to 6.6.0-152.0.0