- !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list - !20704 kernel support hisi-cca-da - !20180 [virtCCA Live Migration 2]virtcca secure cvm supports live migration - !20905 v2 KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20965 iommu/ummu: Optimized TID invalidation and tdev initialization - !20964 iommu/ummu: Support TID and EID Granularity for MPAM - !20970 ub: ubase&unic: Supporting the black box capability of the ubase&unic driver - hisi-cca-da: Start dev by rsi call - hisi-cca-da: Set ripas of the bar region as RIPAS_DEV - hisi-cca-da: Support swiotlb and realm memory use - hisi-cca-da: Add smmu info when dev attach - hisi-cca-da: Transfer realm msix access to rmm - hisi-cca-da: Support pcipc sriov capability - hisi-cca-da: Delay realm memory release to kvm_destroy_realm - hisi-cca-da: Create realm s2 host pgtable and map msi mmio to rmm - hisi-cca-da: Add cca realm s2 pgtable framework - hisi-cca-da: Use bitmap to determine whether the command can be forwarded - hisi-cca-da: Restrict Realm SMMU to stage-2 domain only - hisi-cca-da: Add cmd forward mechanism in realm smmu - hisi-cca-da: Add realm smmu event and gerror irq initialization - hisi-cca-da: Add realm smmu stream table initialization - hisi-cca-da: Add realm smmu cmdq and evtq initialization - hisi-cca-da: Add realm smmu initialization - hisi-cca-da: Add relam iommu support to iommufd - hisi-cca-da: Add realm iommu support for vfio-iommu-type1 - hisi-cca-da: Support dev map and unmap - hisi-cca-da: Support dev validate and dev start - hisi-cca-da: VFIO support ccada - hisi-cca-da: Support dev delegate and dev attach - hisi-cca-da: Support root dev delegate and dev init - hisi-cca-da: Add hisilicon extension smc and ccada cmd - hisi-cca-da: Add hisi ccada feature config - !20751 ARM CCA supports hugepage - !20944 ub: ubmempfd: supports for D2H mapping and demapping - !20888 HiSock Enhancement - ub: ubase&unic: Supporting the black box capability of the ubase&unic driver. - net: unic: Resolve the residual MAC address problem - net: unic: Optimized the code for the cmd structure and FEC function. - ub: ubase: add log for post mailbox timeout - ub: ubus: Remove black box header file to include dir - rme: Remove the secret bit of the vring desc addr - rme: improve hisi-cca data mmap and destroy method - !20943 uvb: fix wd_obtain logic err - !20942 urma: fix bond device id not release - !20892 dcache: Limit the minimal number of bucket to two - rme: isolate page when do delegation to avoid migration - rme: hisi-cca supports different levels for mapping ram - rme: rename ccal to hisi-cca - rme: support set ripas for ccal realm vm - rme: support destroy ram data for ccal realm vm - rme: support populate region for ccal realm vm - rme: support map ram for ccal realm vm - rme: support config ccal realm vm - rme: support ccal RMI calls - rme: realm vm supports wfx handler - !20952 urma: introduce ipourma module - iommu/ummu-core: Simplifies tdev initialization resources - iommu/ummu: Optimized log printing - iommu/ummu: Use passed gfp_mask in map_pages callback - uvb: fix wd_obtain logic err - !20949 ub: udma: support user ctl function. - urma: fix bond device id not release - !20901 drivers/ub/sentry: some bugfix - ub: ubmempfd: supports for D2H mapping and demapping - ub: ubmempfd: supports providing services to the QEMU process through file nodes - [virtCCA Live Migration 2]virtcca secure cvm supports live migration - urma: query priority and enable bit, support ring size configuration - urma: implement debugfs, improve boundary checks and error handling logic - urma: implement data plane interaction and statistics - urma: implement ipourma network device operations - urma: ipourma resource management - urma: ipourma resource management and err code - urma: introduce ipourma main module - iommu/ummu: Optimized the TID invalidation configuration - iommu/ummu: Optimized SVA permission table memory allocation approach - iommu/ummu: Adapt UMMU SVA interface adjustment - iommu/ummu: Support TID and EID Granularity for MPAM - !20848 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !20847 urma: sl resource query error - !20908 [OLK-6.6][linux-6.6.y sync] Backport 6.6.108-6.6.110 LTS Patches - !20084 Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - !20929 PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - drivers/ub/sentry: fix check input parameters - ub: udma: support user ctl function. - ub: udma: support uboe function. - ub: udma: bugfix related to query aux info. - !20935 ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - drivers/ub/sentry: do not use magic numbers - !20876 urma: Kernel-mode specific implementations file for Jetty extension interface - urma: sl resource query error - !20873 sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - !20875 sunrpc: fix race in cache cleanup causing stale nextcheck time - ub: ubmem_vmmu: supports IOMMU driver for the UB memory MMU in VMs - ub: ubmem_vmmu: supports parsing and configuring the hardware node information - ub: ubmem_vmmu: HiSilicon ubmem_vmmu Architecture Implementation - !20806 Fix CVE-2025-71225 - !20896 scsi: qla2xxx: Free sp in error path to fix system crash - !20894 scsi: qla2xxx: Delay module unload while fabric scan in progress - !20893 scsi: qla2xxx: Validate sp before freeing associated memory - !20802 Fix CVE-2026-23110 - urma: Kernel-mode specific implementations file for Jetty extension interface - drivers/ub/sentry: fix memory leak in process_urma_data() - drivers/ub/sentry: initialize some variables - PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug - !20770 ub: ubdevshm: supports the memory user to obtain and release shared memory - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mm: simplify folio_expected_ref_count() - ASoC: qcom: audioreach: fix potential null pointer dereference - gcc-plugins: Remove TODO_verify_il for GCC >= 16 - crypto: sha256 - fix crash at kexec - drm/i915/backlight: Return immediately when scale() finds invalid parameters - minmax.h: remove some #defines that are only expanded once - minmax.h: simplify the variants of clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: update some comments - minmax.h: add whitespace around operators and after commas - minmax: fix up min3() and max3() too - minmax: improve macro expansion and type checking - minmax: don't use max() in situations that want a C constant expression - minmax: simplify min()/max()/clamp() implementation - minmax: make generic MIN() and MAX() macros available everywhere - drm/ast: Use msleep instead of mdelay for edid read - gpiolib: Extend software-node support to support secondary software-nodes - ARM: bcm: Select ARM_GIC_V3 for ARCH_BRCMSTB - s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b - kmsan: fix out-of-bounds access to shadow memory - afs: Fix potential null pointer dereference in afs_put_server - ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address - i40e: improve VF MAC filters accounting - i40e: add mask to apply valid bits for itr_idx - HID: asus: add support for missing PX series fn keys - drm/gma500: Fix null dereference in hdmi teardown - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() - net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port - net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() - net: dsa: lantiq_gswip: do also enable or disable cpu port - selftests: fib_nexthops: Fix creation of non-FDB nexthops - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - bnxt_en: correct offset handling for IPv6 destination address - vhost: Take a reference on the task in struct vhost_task. - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - ethernet: rvu-af: Remove slash from the driver name - can: peak_usb: fix shift-out-of-bounds issue - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow - bpf: Reject bpf_timer for PREEMPT_RT - can: rcar_can: rcar_can_resume(): fix s2ram with PSCI - wifi: virt_wifi: Fix page fault on connect - cpufreq: Initialize cpufreq-based invariance before subsys - ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients - arm64: dts: imx8mp: Correct thermal sensor index - mm: folio_may_be_lru_cached() unless folio_test_large() - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm/gup: check ref_count instead of lru before migration - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked" - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - i2c: designware: Add quirk for Intel Xe - mmc: sdhci-cadence: add Mobileye eyeQ support - usb: core: Add 0x prefix to quirks debug output - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - ALSA: usb-audio: Convert comma to semicolon - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - firewire: core: fix overlooked update of subsystem ABI version - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - !20843 [OLK-6.6][linux-6.6.y sync] Backport 6.6.107-6.6.108 LTS Patches - !20869 ub:hisi-ubus: fix bug of security smatch - !20861 CVE-2026-23163 - ub: ubdevshm: supports the memory user to obtain and release shared memory - ub: ubdevshm: supports granting and revoking shared memory permissions - ub: ubdevshm: supports the registration and deregistration of shared memory segments - ub: ubdevshm: supports the registration and deregistration - KVM: arm64: Fix softirq masking in FPSIMD register saving sequence - !20886 Fix CVE-2026-23205 - !20803 Fix CVE-2026-23112 - !20868 sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - !20811 smb/server: fix refcount leak in smb2_open() - !20810 smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - !20809 smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - sunrpc: fix NULL pointer dereference in rpcb_register_inet6 and rpcb_register_inet4 - sunrpc: fix race in cache cleanup causing stale nextcheck time - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Validate sp before freeing associated memory - dcache: Limit the minimal number of bucket to two - !20872 Fix CVE-2026-23220 - !20846 Fix CVE-2026-23193 - !20815 Fix CVE-2026-23216 - !20859 Fix CVE-2026-23179 - !20871 CVE-2026-23096 - !20858 ub: ubase: resolve the cmdq crq overflow problem - bpf: Deprecate hisock unused kfuncs and orig ingress logic - bpf: Add local connect support for hisock - bpf: Add ipv4-mapped ipv6 addr support for hisock - bpf: Add target comm parse to hisock_cmd - bpf: Add multi port parse to hisock_cmd - bpf: Only deploy hisock in server - bpf: Apply BPF_HISOCK_INGRESS to hisock ingress - bpf: Add bpf_handle_ingress/egress_ptype kfunc - bpf: Add bpf_get_skb_ethhdr kfunc - bpf: Add bpf_set_ingress/egress_dev kfunc - bpf: Add bpf_set_ingress_dst kfunc - bpf: Add BPF_HISOCK_INGRESS attach type - cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted - smb: client: fix potential UAF and double free in smb2_open_file() - smb/client: fix memory leak in smb2_open_file() - !20852 ASoC: amd: fix memory leak in acp3x pdm dma ops - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - uacce: fix cdev handling in the cleanup path - Revert "uacce: fix for cdev memory leak" - ub:hisi-ubus: fix bug of security smatch - ub:ubus: injected route event - ub:ubus: Black Box Development - !20865 urma: urma support uboe - sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure - urma: urma support uboe - !20857 ub_fwctl driver adds support for querying some functions - ub:ub_fwctl:Add illegal verification for scc - ub:ub_fwctl:Support querying the historical status of port links - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdkfd: Don't use sw fault filter if retry cam enabled - ub:ub_fwctl:Support querying firmware version numbers - ub: ub_fwctl: Support querying real-time bandwidth statistics - ub:ub_fwctl:Support querying statistical indicators at the ub port and uboe port levels - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - !20854 [URMA] add ping server for urma_ping - urma: add ping server - ub: ubase: resolve the cmdq crq overflow problem - ub: ubase: Optimized the QoS code naming to improve code readability. - ub: ubase&unic: optimizing code and configuration settings. - net: unic: not support query and configure ip by control plane in UBoE - net: unic: fix the automatically enable uc guid promisc mode. - !20844 urma:kernel header of userctl - urma: Kernel-mode header file for Jetty extension interface - ASoC: amd: fix memory leak in acp3x pdm dma ops - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - phy: broadcom: ns-usb3: Fix Wvoid-pointer-to-enum-cast warning (again) - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - !20835 Fix CVE-2026-23084 - minmax: add a few more MIN_T/MAX_T users - minmax: simplify and clarify min_t()/max_t() implementation - minmax: avoid overly complicated constant expressions in VM code - rtc: pcf2127: fix SPI command byte for PCF2131 backport - xhci: dbc: Fix full DbC transfer ring after several reconnects - xhci: dbc: decouple endpoint allocation from initialization - phy: ti: omap-usb2: fix device leak at unbind - phy: Use device_get_match_data() - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - ASoC: wm8974: Correct PLL rate rounding - ASoC: wm8940: Correct typo in control name - ASoC: wm8940: Correct PLL rate rounding - io_uring: include dying ring in task_work "should cancel" state - io_uring: backport io_should_terminate_tw() - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - selftests: mptcp: avoid spurious errors on TCP disconnect - selftests: mptcp: connect: catch IO errors on listen side - rds: ib: Increment i_fastreg_wrs before bailing out - KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - mmc: mvsdio: Fix dma_unmap_sg() nents value - ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - btrfs: tree-checker: fix the incorrect inode ref size check - iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - LoongArch: Check the return value when creating kobj - LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled - LoongArch: Update help info of ARCH_STRICT_ALIGN - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - net: liquidio: fix overflow in octeon_init_instr_queue() - bonding: don't set oif to bond dev when getting NS target destination - net/mlx5e: Consider aggregated port speed during rate configuration - i40e: remove redundant memory barrier when cleaning Tx descs - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - selftests: mptcp: sockopt: fix error messages - mptcp: tfo: record 'deny join id0' info - mptcp: set remote_deny_join_id0 on SYN recv - dpaa2-switch: fix buffer pool seeding for control traffic - btrfs: fix invalid extref key setup when replaying dentry - pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch - wifi: mac80211: fix incorrect type for ret - wifi: mac80211: increase scan_ies_len for S1G - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - !20769 [OLK-6.6][linux-6.6.y sync] Backport 6.6.106-6.6.107 LTS Patches - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - !20776 ub:ubfi: Release the chosen node - !20817 CVE-2026-23094 - !20819 dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - ub:ubus: Add port num check - !20379 [OLK-6.6][sync from OLK-5.10]io_uring: Support forcing sq thread to be idle and woken up by hrtimer - !20830 sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - sched/soft_domain: Increasing NR_MAX_CLUSTER to 32 - btrfs: fix incorrect readahead expansion length - x86: disable image size check for test builds - drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - phy: ti-pipe3: fix device leak at unbind - phy: tegra: xusb: fix device and OF node leak at probe - dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate - usb: gadget: midi2: Fix MIDI2 IN EP max packet size - usb: gadget: midi2: Fix missing UMP group attributes initialization - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - RISC-V: Remove unnecessary include from compat.h - hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active() - hrtimer: Remove unused function - regulator: sy7636a: fix lifecycle of power good gpio - dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - hsr: use rtnl lock when iterating over ports - net: hsr: Add VLAN CTAG filter support - net: hsr: Add support for MC filtering at the slave device - can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - igb: fix link test skipping when interface is admin down - docs: networking: can: change bcm_msg_head frames member to support flexible array - tunnels: reset the GSO metadata before reusing the skb - net: bridge: Bounce invalid boolopts - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - serial: sc16is7xx: fix bug in flow control levels init - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Input: iqs7222 - avoid enabling unused interrupts - mm/khugepaged: fix the address passed to notifier on testing young - btrfs: fix corruption reading compressed range when block size is smaller than page size - btrfs: use readahead_expand() on compressed extents - mm/damon/sysfs: fix use-after-free in state_show() - mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing - mtd: nand: raw: atmel: Fix comment in timings preparation - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - mm/damon/core: set quota->charged_from to jiffies at first charge window - fuse: prevent overflow in copy_file_range return value - fuse: check if copy_file_range() returns larger than requested size - mtd: rawnand: stm32_fmc2: fix ECC overwrite - mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - i2c: i801: Hide Intel Birch Stream SoC TCO WDT - ocfs2: fix recursive semaphore deadlock in fiemap call - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - compiler-clang.h: define __SANITIZE_*__ macros only when undefined - EDAC/altera: Delete an inappropriate dma_free_coherent() call - rcu-tasks: Maintain real-time response in rcu_tasks_postscan() - rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks - rcu-tasks: Maintain lists to eliminate RCU-tasks/do_exit() deadlocks - s390/cpum_cf: Deny all sampling events by counter PMU - NFSv4/flexfiles: Fix layout merge mirror check. - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFS: Serialise O_DIRECT i/o and truncate() - fs/nfs/io: make nfs_start_io_*() killable - ftrace/samples: Fix function size computation - NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server - NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set - media: i2c: imx214: Fix link frequency validation - NFSD: nfsd_unlink() clobbers non-zero status returned from fh_fill_pre_attrs() - nfsd: Fix a regression in nfsd_setattr() - kasan: fix GCC mem-intrinsic prefix with sw tags - kunit: kasan_test: disable fortify string checker on kasan_strings() test - io_uring: fix kabi broken in struct io_ring_ctx - io_uring: Support forcing sq thread to be idle and woken up by hrtimer - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() - uacce: fix isolate sysfs check condition - Revert "uacce: fix isolate sysfs check condition" - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - smb/server: fix refcount leak in smb2_open() - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - md: suspend array while updating raid_disks via sysfs - scsi: core: Wake up the error handler when final completions race against each other - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - ub:ubfi: Release the chosen node - ub:ubus: Delete unused functions - Loongarch: Enable CONFIG_CRYPTO_XTS for disk encryption - Add sw64 support in kernel.spec - !21194 hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - !21192 urma: bugfix of ubagg&ubcore&uburma - !21183 platform/x86: classmate-laptop: Add missing NULL pointer checks - urma: bugfix of ubagg&ubcore&uburma - hisi-cca-da: Revert smmu realm enabled condition for arm_smmu_domain_finalise. - platform/x86: classmate-laptop: Add missing NULL pointer checks - !21167 urma: fix kernel codecheck issues. - !21174 urma: change return value for provider err - !21127 urma: copy linked ports when importing bond jetty/seg - !20247 ubcore: query primary eid in ipourma loopback mode. - !21077 Fix hisi cca bugs - ubcore: route query refine and ipo loopback adapt. - hisi-cca-da: Transfer PCIe ECAM access requests to RMM for realm device. - hisi-cca-da: Write NS STE for PF drivers. - hisi-cca-da: Provide IO interfaces - hisi-cca-da: Destroy mmu stage2 pagetable after closing vfio devices - !21045 scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - hisi-cca-da: Automatically unbind PF/VF drivers and prevent probe. - !21165 tools/interference: add ifstool utility for kernel interference statistics - !21166 urma: fix jfce uaf in batch cleanup - !21043 urma: fix tjetty ref in ping server - urma: change return value for provider err - !21128 sched/rt: Skip currently executing CPU in rto_next_cpu() - !21129 procfs: fix missing RCU protection when reading real_parent in do_task_stat() - urma: fix jfce uaf in batch cleanup - !21074 ipmi: Add HiSilicon IPMI Page Soft Offline driver - !21076 [OLK-6.6][linux-6.6.y sync] Backport 6.6.112-6.6.113 LTS Patches - urma: fix kernel codecheck issues. - tools/interference: add ifstool utility for kernel interference statistics - !20291 [Hygon][6.6][Bugfix] Bug fix for EDAC decode address fail issue on Hygon Dhyana processor - !21092 kexec: derive purgatory entry from symbol - !21154 sched: Add SOFT_DOMAIN feature interface for cgroup2 - !21153 fix CVE-2025-39981 - Revert "hisi-cca-da: Delay realm memory release to kvm_destroy_realm" - urma: fix tjetty ref in ping server - rme: Enforce isolation to solve compile error without config CONFIG_HISI_CCA - hisi-cca-da: Improve hisi cca dev validate and delegate - hisi-cca-da: Fix smmu enable rme problem - hisi-cca-da: Fix msi region shared problem - sched: Add SOFT_DOMAIN feature interface for cgroup2 - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete - overflow: Introduce __DEFINE_FLEX for having no initializer - overflow: Fix direct struct member initialization in _DEFINE_FLEX() - overflow: Change DEFINE_FLEX to take __counted_by member - overflow: add DEFINE_FLEX() for on-stack allocs - Bluetooth: MGMT: Fix possible UAFs - Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() - !21103 Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !21104 v2 vsock/virtio: cap TX credit to local buffer size - !21070 Fixes CVE-2026-23100 - !21135 RDMA/hns: Support configure and query the CNP DSCP through sysfs - !21088 ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - RDMA/hns: Support configure and query the CNP DSCP through sysfs - RDMA/hns: Support query FW cap bit - RDMA/hns: Support query HW ID. - !20934 smb/server: fix refcount leak in parse_durable_handle_context() - !21004 regmap: Fix race condition in hwspinlock irqsave routine - !19568 [OLK-6.6]fix txgbe clang compile warning - urma: copy linked ports when importing bond jetty/seg - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - sched/rt: Skip currently executing CPU in rto_next_cpu() - !21073 scsi: qla2xxx: Fix bsg_done() causing double free - !21114 CVE-2024-57979 - !21113 iommu: disable SVA when CONFIG_X86 is set - !20957 dmaengine: xilinx: xdma: Fix regmap max_register - !21087 net: unic: Multiple stability fixes for tx timeout, DFX capability and concurrent activation/reset - pps: Fix a use-after-free - fix kabi - pps: Fix a use-after-free - !21078 of: unittest: Fix memory leak in unittest_data_add() - !21079 *** fix CVE-2026-23208 *** - !21082 ALSA: aloop: Fix racy access at PCM trigger - !21083 bus: fsl-mc: fix use-after-free in driver_override_show() - iommu: disable SVA when CONFIG_X86 is set - vsock/virtio: cap TX credit to local buffer size - Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()" - !20983 Fix CVE-2026-23139 - !20878 Fix CVE-2026-23230 - kexec: derive purgatory entry from symbol - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - rtc: interface: Alarm race handling should not discard preceding error - perf test stat tests: Fix for virtualized machines - perf test stat: Update test expectations and events - perf test stat: Avoid hybrid assumption when virtualized - writeback: Avoid excessively long inode switching times - writeback: Avoid softlockup when switching many inodes - cramfs: Verify inode mode when loading from disk - fs: Add 'initramfs_options' to set initramfs mount options - minixfs: Verify inode mode when loading from disk - irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - irqchip/sifive-plic: Make use of __assign_bit() - selftests/mm: skip soft-dirty tests when CONFIG_MEM_SOFT_DIRTY is disabled - s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL - s390/bpf: Describe the frame using a struct instead of constants - s390/bpf: Centralize frame offset calculations - s390/bpf: Change seen_reg to a mask - ACPI: property: Do not pass NULL handles to acpi_attach_data() - ACPI: property: Add code comments explaining what is going on - ACPI: property: Disregard references in data-only subnode lists - ACPI: battery: Add synchronization between interface updates - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: allocate driver data through devm_ APIs - arm64: mte: Do not flag the zero page as PG_mte_tagged - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - !20790 dm: use bio_clone_blkg_association - ipmi: Add HiSilicon IPMI Page Soft Offline driver - net: unic: Resolve network unavailability caused by concurrent activation and reset - net: unic: Provide the DFX capability for querying MNG table - net: unic: Delete the elr reset process after the tx timeout - bus: fsl-mc: fix use-after-free in driver_override_show() - ALSA: aloop: Fix racy access at PCM trigger - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames - of: unittest: Fix memory leak in unittest_data_add() - !21034 CVE-2026-23140 - !21016 net: fix segmentation of forwarding fraglist GRO - !21017 mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - !21018 CVE-2026-23209 - !21019 ipv6: annotate data-race in ndisc_router_discovery() - !20881 ipvlan: Make the addrs_lock be per port - rme: Imporve range delegate - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release - PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() - misc: fastrpc: Save actual DMA size in fastrpc_map structure - misc: fastrpc: Add missing dev_err newlines - mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - media: mc: Clear minor number before put device - lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older - ACPICA: Allow to skip Global Lock initialization - ext4: validate ea_ino and size in check_xattrs - ext4: correctly handle queries for metadata mappings - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - selftests: mptcp: join: validate C-flag + def limit - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Flush posted register writes before INDAC access - PCI: tegra194: Handle errors in BPMP response - PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq() - PCI: rcar-host: Convert struct rcar_msi mask_lock into raw spinlock - PCI: rcar-host: Drop PMSR spinlock - PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit - PCI/AER: Support errors introduced by PCIe r6.0 - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/ERR: Fix uevent on failure to recover - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/sysfs: Ensure devices are powered for config reads - PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - rseq/selftests: Use weak symbol reference, not definition, to link with glibc - rtc: interface: Fix long-standing race when setting alarm - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - mmc: core: SPI mode remove cmd7 - mtd: rawnand: fsmc: Default to autodetect buswidth - xtensa: simdisk: add input size check in proc_write_simdisk - sparc: fix error handling in scan_one_device() - sparc64: fix hugetlb for sun4u - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - sched/deadline: Fix race in push_dl_task() - pwm: berlin: Fix wrong register in suspend/resume - powerpc/pseries/msi: Fix potential underflow and leak issue - powerpc/powernv/pci: Fix underflow and leak issue - power: supply: max77976_charger: fix constant current reporting - pinctrl: samsung: Drop unused S3C24xx driver data - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - parisc: don't reference obsolete termio struct for TC* constants - openat2: don't trigger automounts with RESOLVE_NO_XDEV - of: unittest: Fix device reference count leak in of_unittest_pci_node_verify - lib/genalloc: fix device leak in of_gen_pool_get() - KEYS: trusted_tpm1: Compare HMAC values in constant time - iommu/vt-d: PRS isn't usable if PDS isn't supported - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - init: handle bootloader identifier in kernel parameters - iio: xilinx-ams: Unmask interrupts after updating alarms - iio: xilinx-ams: Fix AMS_ALARM_THR_DIRECT_MASK - iio: frequency: adf4350: Fix prescaler usage. - iio: dac: ad5421: use int type to store negative error codes - iio: dac: ad5360: use int type to store negative error codes - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fbdev: Fix logic error in "offb" name match - crypto: rockchip - Fix dma_unmap_sg() nents value - crypto: atmel - Fix dma_unmap_sg() direction - crypto: aspeed - Fix dma_unmap_sg() direction - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - bus: mhi: ep: Fix chained transfer handling in read path - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - blk-crypto: fix missing blktrace bio split events - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/rcar-du: dsi: Fix 1/2/3 lane support - media: lirc: Fix error handling in lirc_register() - media: venus: firmware: Use correct reset sequence for IRIS2 - media: pci: ivtv: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: i2c: mt9v111: fix incorrect type for ret - media: cx18: Add missing check after DMA map - firmware: meson_sm: fix device leak at probe - xen/events: Update virq_to_irq on migration - xen/events: Return -EEXIST for bound VIRQs - xen/manage: Fix suspend error path - xen/events: Cleanup find_virq() return codes - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - arm64: dts: ti: k3-am62a-main: Fix main padcfg length - arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees - arm64: dts: qcom: msm8939: Add missing MDSS reset - arm64: dts: qcom: msm8916: Add missing MDSS reset - ACPI: debug: fix signedness issues in read/write helpers - ACPI: property: Fix buffer properties extraction for subnodes - gpio: wcd934x: mark the GPIO controller as sleeping - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - smb: client: fix missing timestamp updates after utime(2) - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - drm/amd/display: Properly disable scaling on DCE6 - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amdgpu: Add additional DCE6 SCL registers - mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - perf python: split Clang options when invoking Popen - tools build: Align warning options with perf - net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe - drm/vmwgfx: Fix copy-paste typo in validation - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - LoongArch: Init acpi_gbl_use_global_lock to false - LoongArch: Remove CONFIG_ACPI_TABLE_UPGRADE in platform_init() - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue - clk: tegra: do not overallocate memory for bpmp clocks - clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver - clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate() - clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - perf evsel: Ensure the fallback message is always written to - perf tools: Add fallback for exclude_guest - perf test: Add a test for default perf stat command - perf test: Don't leak workload gopipe in PERF_RECORD_* - perf session: Fix handling when buffer exceeds 2 GiB - perf arm_spe: Correct memory level for remote access - perf arm_spe: Correct setting remote access - rtc: optee: fix memory leak on driver removal - rtc: x1205: Fix Xicor X1205 vendor prefix - perf util: Fix compression checks returning -1 as bool - clk: at91: peripheral: fix return value - libperf event: Ensure tracing data is multiple of 8 sized - perf evsel: Avoid container_of on a NULL leader - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - clocksource/drivers/clps711x: Fix resource leaks in error paths - fscontext: do not consume log entries when returning -EMSGSIZE - fs: always return zero on success from replace_fd() - !21067 [OLK-6.6][linux-6.6.y sync] Backport 6.6.111-6.6.112 LTS Patches - scsi: qla2xxx: Fix bsg_done() causing double free - !21065 Fix CVE-2026-23069 - !21062 v4 Support multi-level cgroup - !20987 Fix CVE-2026-23212 - !20982 Fix CVE-2026-23119 - !20979 Fix CVE-2026-23111 - !20974 Fix CVE-2026-23099 - !20973 Fix CVE-2026-23105 - !20972 Fix CVE-2026-23074 - !20884 ksmbd: add chann_lock to protect ksmbd_chann_list xarray - !20947 Fix CVE-2026-23101 - ext4: clear i_state_flags when alloc inode - misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - !20825 efivarfs: fix error propagation in efivar_entry_get() - !20824 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - !20950 ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - mm/rmap: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix hugetlb_pmd_shared() - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - !20728 drivers: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - !21001 Fix CVE-2026-23229 - usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call - arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode - !20999 Fix CVE-2026-23173 - usb: typec: tipd: Clear interrupts first - bus: fsl-mc: Check return value of platform_get_resource() - remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - Input: atmel_mxt_ts - allow reset GPIO to sleep - misc: fastrpc: Skip reference for DMA handles - misc: fastrpc: fix possible map leak in fastrpc_put_args - misc: fastrpc: Fix fastrpc_map_lookup operation - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - ext4: fix checks for orphan inodes - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - LoongArch: Automatically disable kaslr if boot from kexec_file - mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - mfd: rz-mtu3: Fix MTU5 NFCR register offset - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - vhost: vringh: Modify the return value check - net/mlx5: fw reset, add reset timeout work - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: Stop polling for command response if interface goes down - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - nfp: fix RSS hash key size when RSS is not supported - mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands - drivers/base/node: fix double free in register_one_node() - hwrng: ks-sa - fix division by zero in ks_sa_rng_init - KEYS: X.509: Fix Basic Constraints CA flag parsing - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - vhost: vringh: Fix copy_to_iter return value check - RDMA/siw: Always report immediate post SQ errors - usb: vhci-hcd: Prevent suspending virtually attached devices - NFSv4.1: fix backchannel max_resp_sz verification check - coresight: trbe: Return NULL pointer for allocation failures - coresight: etm4x: Support atclk - coresight-etm4x: Conditionally access register TRCEXTINSELR - remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert() - vfio/pds: replace bitmap_free with vfree - sparc: fix accurate exception reporting in copy_{from,to}_user for M7 - sparc: fix accurate exception reporting in copy_to_user for Niagara 4 - sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara - sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III - wifi: mac80211: fix Rx packet handling when pubsta information is not available - wifi: ath10k: avoid unnecessary wait for service ready message - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - IB/sa: Fix sa_local_svc_timeout_ms read race - RDMA/core: Resolve MAC of next-hop device without ARP support - f2fs: fix zero-sized extent for precache extents - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: edif: Fix incorrect sign of error code - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - RDMA/cm: Rate limit destroy CM ID timeout error message - drivers/base/node: handle error properly in register_one_node() - watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - fs: ntfs3: Fix integer overflow in run_unpack() - drm/msm/dpu: fix incorrect type for ret - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - misc: genwqe: Fix incorrect cmd field being reported in error - usb: gadget: configfs: Correctly set use_os_string at bind - usb: phy: twl6030: Fix incorrect type for ret - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - tcp: fix __tcp_close() to only send RST when required - PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - wifi: mwifiex: send world regulatory domain to driver - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amdgpu: Power up UVD 3 for FW validation (v2) - coresight: Only register perf symlink for sinks with alloc_buffer - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - media: st-delta: avoid excessive stack usage - ALSA: lx_core: use int type to store negative error codes - media: rj54n1cb0c: Fix memleak in rj54n1_probe() - scsi: myrs: Fix dma_alloc_coherent() error check - hwrng: nomadik - add ARM_AMBA dependency - crypto: keembay - Add missing check after sg_nents_for_len() - drm/amd/display: Remove redundant semicolons - serial: max310x: Add error checking in probe() - usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup - phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - media: zoran: Remove zoran_fh structure - drm/bridge: it6505: select REGMAP_I2C - f2fs: fix condition in __allow_reserved_blocks() - drm/radeon/r600_cs: clean up of dead code in r600_cs - drm/panel: novatek-nt35560: Fix invalid return value - bpf: Enforce expected_attach_type for tailcall compatibility - i2c: designware: Add disabling clocks when probe fails - i2c: designware: Fix clock issue when PM is disabled - i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - thermal/drivers/qcom/lmh: Add missing IRQ includes - thermal/drivers/qcom: Make LMH select QCOM_SCM - hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems - once: fix race by moving DO_ONCE to separate section - smp: Fix up and expand the smp_call_function_many() kerneldoc - selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported - i3c: master: svc: Recycle unused IBI slot - i3c: master: svc: Use manual response for IBI events - ACPICA: Fix largest possible resource descriptor index - pwm: tiehrpwm: Fix corner case in clock divisor calculation - arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible - arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names - cpuidle: qcom-spm: fix device and OF node leaks at probe - firmware: firmware: meson-sm: fix compile-test default - arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0 - null_blk: Fix the description of the cache_size module argument - pinctrl: renesas: Use int type to store negative error codes - power: supply: cw2015: Fix a alignment coding style issue - PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS - ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax - block: use int to store blk_stack_limits() return value - selftests/nolibc: fix EXPECT_NZ macro - regulator: scmi: Use int type to store negative error codes - arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map - ARM: at91: pm: fix MCKx restore routine - pinctrl: meson-gxl: add missing i2c_d pinmux - soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - leds: flash: leds-qcom-flash: Update torch current clamp setting - ARM: dts: renesas: porter: Fix CAN pin group - libbpf: Fix reuse of DEVMAP - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - bpf/selftests: Fix test_tcpnotify_user - regmap: Remove superfluous check for !config in __regmap_init() - arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - x86/vdso: Fix output operand size of RDPID - smb: server: fix IRD/ORD negotiation with the client - coresight: trbe: Prevent overflow in PERF_IDX2OFF() - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - selftests: arm64: Check fread return value in exec_target - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - filelock: add FL_RECLAIM to show_fl_flags() macro - !21022 KVM: Don't clobber irqfd routing type when deassigning irqfd - !20998 ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !21023 l2tp: avoid one data-race in l2tp_tunnel_del_work() - xsched: fix potential NULL dereference in xsched_quota_timeout_update - xsched: remove the standalone xcu_cfs_cg_deinit() helper - xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle - xsched: simplify root group check by direct comparison with root_xcg - xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length - xsched/core: immediate cleanup of remaining operators on task exit - xsched: add init_fair_xsched_group() for XCU-specific fair group initialization - xsched: modify xcu_cg_initialize_components helper - xsched: refactor xsched_entity initialization - xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq - xsched: harden and clarify xcu_move_task() logic - xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs - xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling - xsched/quota: support multi-level cgroup - xsched: remove redundant xcu parameter from dequeue_ctx - xsched: update group shares using xcu_grp_shares_add/sub helpers - xsched: delete unused code - xsched/cfs: propagate group activation/deactivation up the hierarchy - xsched/cfs: move xruntime updates to pick/put paths - xsched: add has_running hook to xsched classes for wake-up eligibility check - !21012 [OLK-6.6][linux-6.6.y sync] Backport 6.6.110-6.6.111 LTS Patches - scsi: hisi_sas: Fix NULL pointer exception when do user_scan() - !21013 CVE-2026-23177 - !21007 bonding: fix use-after-free due to enslave fail after slave array update - !21006 net: Fix CVE-2026-23204 - bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path - bpf, test_run: Subtract size of xdp_frame from allowed metadata size - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - !21015 libceph: reset sparse-read state in osd_fault() - !21024 ub: udma: bugfix related to print messages. - !20980 Fix CVE-2026-23126 - !20922 Fix CVE-2026-23133 - ub: udma: bugfix related to print messages. - l2tp: avoid one data-race in l2tp_tunnel_del_work() - KVM: Don't clobber irqfd routing type when deassigning irqfd - ipv6: annotate data-race in ndisc_router_discovery() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - macvlan: fix error recovery in macvlan_common_newlink() - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() - net: fix segmentation of forwarding fraglist GRO - can: rcar_canfd: Fix CAN-FD mode as default - libceph: reset sparse-read state in osd_fault() - !21008 uvb: fix cis call return value and obtain - mm, shmem: prevent infinite loop on truncate race - mm/shmem, swap: fix race of truncate and swap entry split - net/9p: fix double req put in p9_fd_cancelled - riscv: mm: Do not restrict mmap address based on hint - riscv: mm: Use hint address in mmap if available - driver core/PM: Set power.no_callbacks along with power.no_pm - serial: stm32: allow selecting console when the driver is module - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - ALSA: usb-audio: Kill timer properly at removal - platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - can: rcar_canfd: Fix controller mode setting - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - btrfs: ref-verify: handle damaged extent root tree - ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - perf subcmd: avoid crash in exclude_cmds when excludes is empty - platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - dm-integrity: limit MAX_TAG_SIZE to 255 - ASoC: amd: acp: Adjust pdm gain value - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - USB: serial: option: add SIMCom 8230C compositions - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe - !20931 Fix CVE-2026-23060 - uvb: fix cis call return value and obtain - bonding: fix use-after-free due to enslave fail after slave array update - net/sched: cls_u32: use skb_header_pointer_careful() - net: add skb_header_pointer_careful() helper - regmap: Fix race condition in hwspinlock irqsave routine - crypto: virtio - Add spinlock protection with virtqueue notification - net/mlx5e: TC, delete flows only for existing peers - !20967 net: hns3: modify code of judging if SMMU DMA is enabled - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - !20969 Fix CVE-2026-23125 - !20948 v4 arm64: Add memory poison recovery support for various paths - !20975 CVE-2026-23102 - !20977 v4 support apei_page_offline_policy - bonding: annotate data-races around slave->last_rx - netfilter: nf_conncount: update last_gc only when GC has been performed - bonding: provide a net pointer to __skb_flow_dissect() - netdevsim: fix a race issue related to the operation on bpf_bound_progs list - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - apei/ghes: Add sysctl interface to control soft-offline page isolation - Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - arm64/fpsimd: signal: Fix restoration of SVE context - arm64/fpsimd: signal: Consistently read FPSIMD context - arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state - bonding: limit BOND_MODE_8023AD to Ethernet devices - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - net/sched: Enforce that teql can only be used as root qdisc - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - drivers/net: Update vendor name of Chengdu NorthLink Technology N5/N6 Series Network Card Drivers - net: hns3: modify code of judging if SMMU DMA is enabled - dmaengine: xilinx: xdma: Fix regmap max_register - ub:ubus: protect iterator ue_list and mue_list with ub_bus_sem - ub:ubus: Avoid getting empty uent from ubc - ub:hisi-ubus: Use GFP_ATOMIC when alloc memory - arm64: send sig fault for user task when apei_claim_sea fails - arm64: add ras log during do_sea - arm64: move getting valid siaddr to the top of do_sea - arm64: mm: shmem: support poison recovery from shmem_file_read_iter() - arm64: fs: support poison recovery from __kernel_read() - iov_iter: add mc support for copy_page_to_iter - arm64: mm: support recovery from copy_{from/to}_user_page() - iov_iter: get rid of 'copy_mc' flag - leds: led-class: Only Add LED to leds_list when it is fully ready - wifi: ath10k: fix dma_free_coherent() pointer - smb/server: fix refcount leak in parse_durable_handle_context() - ksmbd: add chann_lock to protect ksmbd_chann_list xarray - ipvlan: Make the addrs_lock be per port - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - efivarfs: fix error propagation in efivar_entry_get() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - dm: use bio_clone_blkg_association - RAS/AMD/ATL: fix error nodes per socket on for Hygon Dhyana processor - net: txgbe: fix clang compile warning - !21258 ub:hisi-ubus: Review of Readability Modifications - !21293 urma: update urma_admin agg expose flag - urma: update urma_admin agg expose - !21227 [OLK-6.6][linux-6.6.y sync] Backport 6.6.114-6.6.115 LTS Patches - !21270 l2tp: fix double dst_release() on sk_dst_cache race - !21272 mptcp: fix soft lockup in mptcp_recvmsg() - !20994 urma: support comm endpoint - !21245 urma: support non-root execute 'urma_ping' and 'urma_admin show topo' - !21271 urma: fix useless copy_logic_device and use expose instead. - urma: support non-root execute in containers - urma: fix useless copy_logic_device and use expose instead. - ub:hisi-ubus: Review of Readability Modifications - mptcp: fix soft lockup in mptcp_recvmsg() - mptcp: fix MSG_PEEK stream corruption - l2tp: fix double dst_release() on sk_dst_cache race - urma: update urma_admin agg expose - !21252 arm64: Set __nocfi on swsusp_arch_resume() - !21226 hisi-cca-da: Fix potential data overflow. - !19706 [OLK-6.6]:update patches for sw64 architecture - !21253 xattr: switch to CLASS(fd) - !21255 ub: cdma: cdma bug fix - !21241 net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - ub: cdma: cdma bug fix - xattr: switch to CLASS(fd) - arm64: Set __nocfi on swsusp_arch_resume() - hisi-cca-da: Fix error where multiple devices share the same SMMU domain. - net/ipv4:scmtcp: fix soft lockup caused by spin_lock in soft irq - net/ipv4:scmtcp: fix panic caused by file_htable_del_flist - !21237 urma: change warn log into info for topo query - hisi-cca-da: Fix potential data overflow. - !21210 urma: fix tjetty tp type in ping server - !21224 arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - !21240 urma: update urma_admin agg expose - !21042 net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - urma: update urma_admin agg expose - net/ipv4: introduce IPPROTO_SCMTCP for SCM_RIGHTS - !21238 urma: delete ubcm_genl implementation - urma: delete ubcm_genl implementation - urma: change warn log into info for topo query - tcpm: allow looking for role_sw device in the main node - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - most: usb: fix double free on late probe failure - arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - net: enetc: fix build warning when PAGE_SIZE is greater than 128K - gpio: ljca: Initialize num before accessing item in ljca_gpio_config - s390/cio: Update purge function to unregister the unused subchannels - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - xfs: always warn about deprecated mount options - devcoredump: Fix circular locking dependency with devcd->mutex. - serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - serial: 8250_dw: handle reset control deassert error - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - tcpm: switch check for role_sw device with fw_node - most: usb: hdm_probe: Fix calling put_device() before device initialization - most: usb: Fix use-after-free in hdm_disconnect - mei: me: add wildcat lake P DID - comedi: fix divide-by-zero in comedi_buf_munge() - binder: remove "invalid inc weak" check - x86/microcode: Fix Entrysign revision check for Zen1/Naples - xhci: dbc: enable back DbC in resume if it was enabled before suspend - usb: raw-gadget: do not limit transfer length - usb/core/quirks: Add Huawei ME906S to wakeup quirk - USB: serial: option: add Telit FN920C04 ECM compositions - USB: serial: option: add Quectel RG255C - USB: serial: option: add UNISOC UIS7720 - sched: Remove never used code in mm_cid_get() - io_uring: correct __must_hold annotation in io_install_fixed_file - gpio: ljca: Fix duplicated IRQ mapping - gpio: update Intel LJCA USB GPIO driver - hwmon: (sht3x) Fix error handling - RISC-V: Don't print details of CPUs disabled in DT - RISC-V: Define pgprot_dmacoherent() for non-coherent devices - firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - spi: spi-nxp-fspi: add extra delay after dll locked - selftests: mptcp: join: mark implicit tests as skipped if not supported - selftests: mptcp: join: mark 'flush re-add' as skipped if not supported - net: ravb: Ensure memory write completes before ringing TX doorbell - net: ravb: Enforce descriptor type ordering - net: usb: rtl8150: Fix frame padding - net: stmmac: dwmac-rk: Fix disabling set_clock_selection - ocfs2: clear extent cache after moving/defragmenting extents - MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering - cifs: Fix TCP_Server_Info::credits to be signed - gpio: 104-idio-16: Define maximum valid register address offset - gpio: pci-idio-16: Define maximum valid register address offset - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - net: bonding: fix possible peer notify event loss or dup issue - arm64, mm: avoid always making PTE dirty in pte_mkwrite() - !21236 Fix TLBI broadcast optimization loss and incorrect dvmbm handling - KVM: arm64: Fix CCA guest panic when dvmbm is enabled - !21228 ub:ubus: add reset function - !21220 selftests/bpf: Add cross-build support for urandom_read et al - !21214 optimize lightweight load balancing - ub:ubus: add reset function - !21218 ub_fwctl modifies the interception and concurrency verification of commands in different scenarios - !21221 iommu/ummu: Modify the ummu/tid permission - selftests: net: fix server bind failure in sctp_vrf.sh - selftests/net: convert sctp_vrf.sh to run it in unique namespace - can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() - dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net: enetc: correct the value of ENETC_RXB_TRUESIZE - net: enetc: fix the deadlock of enetc_mdio_lock - net: Tree wide: Replace xdp_do_flush_map() with xdp_do_flush(). - rtnetlink: Allow deleting FDB entries in user namespace - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - Unbreak 'make tools/*' for user-space targets - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - powerpc/32: Remove PAGE_KERNEL_TEXT to fix startup failure - m68k: bitops: Fix find_*_bit() signatures - lkdtm: fortify: Fix potential NULL dereference on kmalloc failure - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - dlm: check for defined force value in dlm_lockspace_release - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: make proper initalization of struct hfs_find_data - hfs: clear offset and space out of valid records in b-tree node - nios2: ensure that memblock.current_limit is set when setting pfn limits - exec: Fix incorrect type for ret - !21222 ub: ubase: Added the interface for obtaining hardware version information - !21175 iommu/ummu: Optimize ummu register compatibility ubmem processing - !21216 Fix RT priority Setting - arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc() - iommu/ummu: Modify the ummu/tid permission - ub: ubase&unic: Optimize the code for log information - ub: ubase: Solve The out-of-bounds problem of accessing a variable of the u16 type through unsigned long - ub: ubase: Fix the issue where the himac reset cannot be triggered during an elr reset - ub:ub_fwctl:Add a mutex lock - ub:ub_fwctl:Add interception and validation for unsupported environment commands - ub: ubase: Added the interface for obtaining hardware version information. - selftests/bpf: Add cross-build support for urandom_read et al - !21217 Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21205 arm64/mpam: Fix wrong closid config access when CDP is enabled - !21169 [OLK-6.6][linux-6.6.y sync] Backport 6.6.113-6.6.114 LTS Patches - Revert "drivers: core: synchronize really_probe() and dev_uevent()" - !21213 ub:ubus: alter nl ssu credit ras recover - iommu/ummu: Optimize the duplicate code - xsched: initialize tgid before configuring RT priority - xsched: fix typo in xcu cgroup subsys released callback name - xsched: refactor xse_this_grp_xcu to xse_this_cfs_rq for clarity and correctness - sched: expand sysctl_sched_features to unsigned long - sched: Fix kabi breakage of struct sched_domain for newidle_stats - sched/fair: Proportional newidle balance - ub:ubus: alter nl ssu credit ras recover - ub:ubus add some missing code to openeuler - change bus instance create EID_BYPASS - urma: fix tjetty tp type in ping server - iommu/ummu: Optimize the definition of 'hisi_ummu_tdev_info' - iommu/ummu: Delete the unused interface of the UMMU - arm64/mpam: Fix wrong closid config access when CDP is enabled - Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" - iommu/ummu: Remove the constraint that l_tid must be valid - iommu/ummu: Remove redundant read register operations - iommu/ummu: Optimize the UMMU instance matching logic - iommu/ummu: Improve the reliability of ummu initialization - iommu/ummu: Modify parameter for separated page table - drm/amd: Fix suspend failure with secure display TA - PCI: tegra194: Reset BARs when running in PCIe endpoint mode - PCI: j721e: Fix programming sequence of "strap" settings - PCI: j721e: Enable ACSPCIE Refclk if "ti,syscon-acspcie-proxy-ctrl" exists - ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL - PCI/sysfs: Ensure devices are powered for config reads (part 2) - nfsd: decouple the xprtsec policy check from check_nfsd_access() - phy: cadence: cdns-dphy: Update calibration wait time for startup state machine - xfs: use deferred intent items for reaping crosslinked blocks - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure - phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling - phy: cdns-dphy: Store hs_clk_rate and return it - iio: imu: inv_icm42600: Simplify pm_runtime setup - PM: runtime: Add new devm functions - xfs: fix log CRC mismatches between i386 and other architectures - xfs: rename the old_crc variable in xlog_recover_process - NFSD: Fix last write offset handling in layoutcommit - NFSD: Minor cleanup in layoutcommit processing - NFSD: Rework encoding and decoding of nfsd4_deviceid - nilfs2: fix deadlock warnings caused by lock dependency in init_nilfs() - block: fix race between set_blocksize and read paths - arm64: errata: Apply workarounds for Neoverse-V3AE - arm64: cputype: Add Neoverse-V3AE definitions - selftests: arg_parsing: Ensure data is flushed to disk before reading. - HID: multitouch: fix name of Stylus input devices - HID: hid-input: only ignore 0 battery events for digitizers - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - selftests/bpf: make arg_parsing.c more robust to crashes - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - drm/rockchip: vop2: use correct destination rectangle height check - drm/amd/powerplay: Fix CIK shutdown temperature - drm/i915/guc: Skip communication warning on reset in progress - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - ASoC: nau8821: Generalize helper to clear IRQ status - ASoC: nau8821: Cancel jdet_work before handling jack ejection - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec - drm/bridge: lt9211: Drop check for last nibble of version register - riscv: kprobes: Fix probe address validation - nvme-multipath: Skip nr_active increments in RETRY disposition - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - tls: don't rely on tx_work during send() - tls: always set record_type in tls_process_cmsg - tls: wait for async encrypt in case of error during latter iterations of sendmsg - net: tls: wait for async completion on last message - tls: trim encrypted message to match the plaintext on short splice - tg3: prevent use of uninitialized remote_adv and local_adv variables - tcp: fix tcp_tso_should_defer() vs large RTT - amd-xgbe: Avoid spurious link down messages during interface toggle - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - doc: fix seg6_flowlabel path - net: dlink: handle dma_map_single() failure properly - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - dax: skip read lock assertion for read-only filesystems - HID: multitouch: fix sticky fingers - usb: gadget: f_rndis: Refactor bind path to use __free() - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: Introduce free_usb_request helper - usb: gadget: Store endpoint pointer in usb_request - media: nxp: imx8-isi: m2m: Fix streaming cleanup on release - media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() - drm/exynos: exynos7_drm_decon: remove ctx->suspended - drm/exynos: exynos7_drm_decon: properly clear channels during bind - drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions - drm/msm/a6xx: Fix PDC sleep sequence - drm/msm/adreno: De-spaghettify the use of memory barriers - eventpoll: Replace rwlock with spinlock - epoll: Remove ep_scan_ready_list() in comments - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - drm/amd: Check whether secure display TA loaded successfully - drm/amdgpu: use atomic functions with memory barriers for vm fault info - cifs: parse_dfs_referrals: prevent oob on malformed input - can: gs_usb: increase max interface to U8_MAX - can: gs_usb: gs_make_candev(): populate net_device->dev_port - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - ext4: wait for ongoing I/O to complete before freeing blocks - jbd2: ensure that all ongoing I/O complete before freeing blocks - f2fs: fix wrong block mapping for multi-devices - r8152: add error handling in rtl8152_driver_init - sw64: ebpf: port arch_prepare_bpf_trampoline() - sw64: fix random mmap base range - sw64: paravirt: add pv steal_time support in guest side - sw64: kvm: add pv steal time support - sw64: pci: remove redundant debug control - fix build failure with 64K page - !21367 ub: udma: bugfix related to jfr id. - !21356 ub: ubase: Improving the reliability of CtrlQ and fasten reboot - !21357 urma: fix add obj type compile error - ub: udma: bugfix related to jfr id. - urma: fix add obj type compile error - ub: ubase: optimized reboot time required - !21350 urma: add obj type in ubcore delete uobj error - !21343 urma: support ubp methods - !21351 arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: support ubp methods; - !21320 urma: decrease session creation max timeout - !21323 urma: tp reuse in RC transmode - !21319 urma: remove legacy bonding dev create/delete - !21342 iommu/ummu: Optimize resource management and eliminate redundant interfaces - ub: ubase: Improving the reliability of CtrlQ. - arm64: fix compile error if CONFIG_ARCH_HAS_COPY_MC not enabled - urma: add obj type in ubcore delete uobj error - urma: Kernel-mode file for tp reuse in RC transmode - iommu/ummu-core: Delete the redundant fields of struct ummu_mpam. - ub:ubfi: Delete device load debug logs - iommu/ummu-core: Fix kref imbalance in VMA split scenario - iommu/ummu-core: Prevent FREE_TID while mmap is active - iommu/ummu: Add deprecation markers for ummu SVA APIs - !21324 mfs: fix mfsd_prefetch.cpp compile error - !21303 net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - !20936 gmem: fix several issues - !21267 drivers/ub/sentry: set the priority to prevent machine being hung up when the load is heavy - !21333 v4 hugetlb: drain pcp for movable zone before alloc - drivers/ub/sentry: set the priority - hugetlb: drain pcp for movable zone before alloc - !21325 mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - gmem: only create vma->vm_obj when peer_va_alloc_fixed return true - gmem: check vma->vm_obj in vm_object_split to avoid NULL ptr deference - gmem: hold mmap_read lock while executing gmem_unmap_region - gmem: Fix a potential double free in exit_mm() by reordering the intialization of mm->gm_as in dup_mm() - gmem: fix hmemcpy src/dest conflict deadlock under concurrency - gmem: fix NULL ptr deference in vm_object_merge - mm/hugetlb: fix memory offline failure due to hwpoisoned file hugetlb - mfs: fix mfsd_prefetch.cpp compile error - !21310 CCA: Add the RSI interface for obtaining the device certificate. - urma: remove legacy bonding dev create/delete - urma: Decrease session creation max timeout - !21316 ub: udma: Move the request for RC context from UDMA to UBASE - net/ipv4:scmtcp: fix scmtcp_sk_recvmsg() return incorrect fds due to RLIMIT_NOFILE - ub: ubase: Move the request for RC context from UDMA to UBASE - !19936 [Intel-SIG]: sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - !21302 [OLK-6.6]:update patches for sw64 architecture - ub: udma: bugfix related to deactivate tp. - ub: udma: bugfix related to jetty group. - !21311 mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - !21312 urma: support remove ubagg & uburma ko - !21223 kvm: add skip vmovp feature support - CCA: Add the RSI interface for obtaining the device certificate. - urma: support remove ubagg & uburma ko - KVM: arm64: vgic-v4: Elide VMOVP on vCPU scheduling within same affinity group - !21276 ub/ubdevshm: Fix some issues - !21292 [OLK-6.6][linux-6.6.y sync] Backport 6.6.115-6.6.116 LTS Patches - !21309 ub:ub_fwctl:Modify the query to address issues that do not meet expectations - ub/ubmem-mmu: Fix some issues - ub/ubmempfd: Add module author - ub/ubdevshm: Fix some issues - mm/shrinker: Implementation of register_shrinker() and unregister_shrinker() - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - perf: sched: Fix perf crash with new is_user_task() helper - ub:ub_fwctl:Modify the statistical port link up/down to only count 10 times - ub:ub_fwctl:When modifying the link information of a query port, verify non-existent ports - !21307 ub: ubase&unic: Stability and Functionality Fixes Collection - net: unic: correct DMA direction for TX path - net: unic: Fix the bug that could cause nconsistent resource state or double-free - net: unic: optimize MAC address deletion to avoid sleeping in spinlock - ub: ubase: Resolve integer wraparound - ub: ubase: Resolve cache coherence and set smp_rmb - ub: ubase&unic: adjust the encoding format of the ubase&unic driver. - ub: ubase: Support udma get ue msg info. - net: unic: The FPGA and EVB compilation macros are deleted from the unic driver. - ub: ubase: The debugfs function supports querying the Ethernet port rate. - sw64: adapt arch_tlbbatch_add_pending according to upstream - sw64: fix the compilation error when CONFIG_DEBUG_VIRTUAL is enabled - sw64: add support for batched TLB flushing during unmap - sw64: fix the parameter passing logic of memblock_mark_nomap - sw64: add HUGE_VMAP support for c4 - sw64: define get_cycles macro - sw64: cpuidle: refine C6 state stability - sw64: add barriers and tlb flush for set_atc - sw64: adapt kernel page table for kdump - sw64: adapt kernel page table for memory hotplug - sw64: set PTBR_SYS before accessing vmalloc area - sw64: set execute permission for virtual machine's hmcode text section - sw64: adjust the marking and definitions of some kernel mapping functions - sw64: adapt kernel page table for S4 - sw64: fix an inappropriate lock in __set_memory - sw64: enable kernel page table - sw64: use ioremap to map IO address in functions like __get_cpu_nums() - sw64: move non-boot core's kernel page table enabling logic to hmcode - sw64: use ioremap to map IO address - sw64: map legacy I/O to K segment - sw64: setup early_ioremap - sw64: reset ATC for kvm - sw64: setup mapping for efi_mm - sw64: set protection for kernel page table - sw64: modify codes with fixmap - sw64: map the early and the final page table - sw64: add fixmap support - sw64: fix mmap_base exceeding Java assertion address - sw64: add memb before/after atomic - sw64: add EDAC support with dynamic node and MC detection - sw64: fix: getcpu passed a null pointer error - sw64: iommu: refactor iommu v2 initialization - sw64: cache: fix shared_cpu_map when PPTT is invalid - sw64: add alternative runtime patching - sw64: pci: fix IO_BASE if numa_off - sw64: use ioremap to map spaces for cpufreq and S3 - sw64: pci: add sunway pci controller for Command Completed errata - sw64: add definitions for kernel-required CPU capabilities - sw64: kvm: add qemu-gdb watchpoint support - sw64: kvm: fix srcu lock leak in pv steal time - gpio: idio-16: Define fixed direction of the GPIO lines - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: regmap: Allow to allocate regmap-irq device - bits: introduce fixed-type GENMASK_U*() - bits: add comments and newlines to #if, #else and #endif directives - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - xhci: dbc: Avoid event polling busyloop if pending rx transfers are inactive. - xhci: dbc: Improve performance by removing delay in transfer event polling. - xhci: dbc: Allow users to modify DbC poll interval via sysfs - xhci: dbc: poll at different rate depending on data transfer activity - serial: sc16is7xx: reorder code to remove prototype declarations - serial: sc16is7xx: remove unused to_sc16is7xx_port macro - selftests: mptcp: join: mark 'delete re-add signal' as skipped if not supported - selftests: mptcp: disable add_addr retrans in endpoint_tests - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: zoned: refine extent allocator hint selection - btrfs: zoned: return error from btrfs_zone_finish_endio() - EDAC/mc_sysfs: Increase legacy channel support to 16 - x86/bugs: Fix reporting of LFENCE retpoline - x86/bugs: Report correct retbleed mitigation status - perf: Skip user unwind if the task is a kernel thread - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - audit: record fanotify event regardless of presence of rules - sched/topology,x86: Fix build warning - sched/topology: Fix sched domain build error for GNR, CWF in SNC-3 mode - sched: Create architecture specific sched domain distances - !21462 urma: Kernel-mode file for bugfix of kerf of tjetty - urma: Kernel-mode file for bugfix of kerf of tjetty - !21456 time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21393 Fix CVE-2026-23268 - !21446 i40e: Fix preempt count leak in napi poll tracepoint - !21441 ext4: fix generic/363 failure in iomap buffered I/O mode - !21200 ub/obmm: delay conti_clear_thread when conti_clear_memseg failed & minor bugfixes - !21450 Fix CVE-2026-23317 - !21429 urma: add workqueue for well_know_jetty - !21439 urma: userctl fuction about fix mode. - !21458 urma: adjust log level to info for get_dev_name - !21425 urma: fix the double free issue of import_cb - !21408 urma: ipourma default sl configuration - urma: usrctrl function about fix mode. - urma: adjust log level to info for get_dev_name - !21436 bpf: Release module BTF IDR before module unload - !21440 v2 CVE-2026-23319 - !21438 bpf: Fix stack-out-of-bounds write in devmap - time/jiffies: Mark jiffies_64_to_clock_t() notrace - !21426 RDMA/umad: Reject negative data_len in ib_umad_write - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - !21421 v3 CVE-2026-23352 - !21380 perf: HiSilicon: Support uncore ITS PMU - !21379 drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - !21391 quota: fix livelock between quotactl and freeze_super - !21390 ext4: fix dirtyclusters double decrement on fs shutdown - !21389 fat: avoid parent link count underflow in rmdir - !21388 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - !21387 ext4: fix memory leak in ext4_ext_shift_extents() - !21386 blktrace: fix __this_cpu_read/write in preemptible context - !21434 Fix CVE-2026-23388 - i40e: Fix preempt count leak in napi poll tracepoint - ub/obmm: delay conti_clear_thread when conti_clear_memseg failed - urma: add workqueue for well_know_jetty - ext4: zero post EOF partial block before iomap appending write - ext4: move pagecache_isize_extended() out of active handle - ext4: remove ctime/mtime update from ext4_alloc_file_blocks() - ext4: unify SYNC mode checks in fallocate paths - ext4: ensure zeroed partial blocks are persisted in SYNC mode - ext4: move zero partial block range functions out of active handle - ext4: pass allocate range as loff_t to ext4_alloc_file_blocks() - ext4: remove handle parameters from zero partial block functions - ext4: move ordered data handling out of ext4_block_do_zero_range() - ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range() - ext4: factor out journalled block zeroing range - ext4: rename and extend ext4_block_truncate_page() - iomap: make zero range flush conditional on unwritten mappings - iomap: fix handling of dirty folios over unwritten extents - ub/obmm: minor bugfixes - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - bpf: export bpf_link_inc_not_zero. - !21406 crypto: hisilicon/qm - support querying the hardware fault status through VFs - crypto: hisilicon/qm - support querying the hardware fault status through VFs - urma: ipourma default sl configuration - bpf: Fix stack-out-of-bounds write in devmap - bpf: Release module BTF IDR before module unload - Squashfs: check metadata block offset is within range - !21346 Revert "net: hns3: add sync command to sync io-pgtable" - !21372 nvme: fix memory allocation in nvme_pr_read_keys() - apparmor: fix unprivileged local user can do privileged policy management - !21423 nvme: fix admin queue leak on controller reset - !21422 scsi: target: Fix recursive locking in __configfs_open_file() - RDMA/umad: Reject negative data_len in ib_umad_write - !21402 CVE-2026-23296 - !21403 fix queue start/stop imbalance under race - urma: fix the double free issue of bind_cb - nvme: fix admin queue leak on controller reset - scsi: target: Fix recursive locking in __configfs_open_file() - x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - x86/efi: defer freeing of boot services memory - !21405 Fix CVE-2025-71239 - !21398 drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21410 urma: disallow user-mode calls for some ubagg userctl ops - !21371 urma: remote all logic device when set dev ns - urma: disallow user-mode calls for some ubagg userctl ops - !21109 filemap: restrict pagecache to non-cpuless NUMA nodes - drivers/ub/sentry: skip memory_failure if pfn is 0x0 - !21314 [OLK-6.6][linux-6.6.y sync] Backport 6.6.116-6.6.117 LTS Patches - audit: add fchmodat2() to change attributes class - urma: remote all logic device when set dev ns - !21348 uvb: support communication in VM - !21378 net/ipv4:scmtcp: fix no dmi_uuid in VM - dm: fix queue start/stop imbalance under remove/resume races - dm: fix queue start/stop imbalance under suspend/load/resume races - scsi: core: Fix error handling for scsi_alloc_sdev() - scsi: core: Fix refcount leak for tagset_refcnt - uvb: support communication in VM - !21313 bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - !21334 prevent SEA storms on critical RAS - !21375 urma: Kernel-mode file for tp reuse in RC transmode - urma: Kernel-mode file for tp reuse in RC transmode and bugfix of uburma and add tp_state - quota: fix livelock between quotactl and freeze_super - ext4: fix dirtyclusters double decrement on fs shutdown - fat: avoid parent link count underflow in rmdir - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - ext4: fix memory leak in ext4_ext_shift_extents() - blktrace: fix __this_cpu_read/write in preemptible context - !21354 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - perf: HiSilicon: Support uncore ITS PMU - drivers/perf: hisi: Add new function for HiSilicon MN PMU driver - net/ipv4:scmtcp: fix no dmi_uuid in VM - !21355 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - !21249 arm64/xcall: add research papers reference in file headers - !21322 nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - !21369 drivers/ub/sentry: add some log for event report - mm/filemap: restrict pagecache to non-cpuless NUMA nodes - mm/mempolicy: add mpol_update_interleave_stats() helper - !21328 genirq: Get rid of global lock in irq_do_set_affinity() - !21282 spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - nvme: fix memory allocation in nvme_pr_read_keys() - !21339 iommu: Revert to using .domain_alloc_user without kvm parameter - spi: hisi-kunpeng: Fixed the wrong debugfs node name in hisi_spi debugfs initialization - Revert "Fixed the wrong debugfs node name in hisi_spi debugfs initialization" - drivers/ub/sentry: add some log for event report - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - iommu: Revert to using .domain_alloc_user without kvm parameter - Revert "net: hns3: add sync command to sync io-pgtable" - regulator: fixed: Rely on the core freeing the enable GPIO - net/mlx5e: Fix validation logic in rate limiting - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - ntfs3: init run lock for extend inode - scsi: ufs: host: mediatek: Require CONFIG_PM - wifi: rtw88: limit indirect IO under powered off for RTL8822CS - pinctrl: keembay: fix double free in keembay_build_functions() - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - mptcp: schedule rtx timer only after pushing data - ACPI: HMAT: Remove register of memory node for generic target - mm/memory-tier: fix abstract distance calculation overflow - mm/truncate: unmap large folio on split failure - mm: memcg: change flush_next_time to flush_last_time - mm: memcg: add per-memcg zswap writeback stat - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - scsi: ufs: core: Add a quirk for handling broken LSDBS field in controller capabilities register - scsi: ufs: core: Add UFSHCD_QUIRK_KEYS_IN_PRDT - scsi: ufs: core: Add fill_crypto_prdt variant op - scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_CRYPTO_ENABLE - scsi: ufs: core: fold ufshcd_clear_keyslot() into its caller - scsi: ufs: core: Add UFSHCD_QUIRK_CUSTOM_CRYPTO_PROFILE - f2fs: fix to avoid overflow while left shift operation - mm, percpu: do not consider sleepable allocations atomic - iommufd: Don't overflow during division for dirty tracking - btrfs: ensure no dirty metadata is written back for an fs with errors - Revert "perf dso: Add missed dso__put to dso__load_kcore" - selftests: mptcp: connect: trunc: read all recv data - selftests: mptcp: join: rm: set backup flag - selftests: mptcp: connect: fix fallback note due to OoO - pmdomain: samsung: plug potential memleak during probe - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection - EDAC/altera: Handle OCRAM ECC enable after warm reset - LoongArch: Use physical addresses for CSR_MERRENTRY/CSR_TLBRENTRY - selftests/user_events: fix type cast for write_index packed member in perf_test - x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - spi: Try to get ACPI GPIO IRQ earlier - smb: client: fix cifs_pick_channel when channel needs reconnect - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - wifi: mac80211: reject address change while connecting - selftests/tracing: Run sample events to clear page cache events - LoongArch: Let {pte,pmd}_modify() record the status of _PAGE_DIRTY - LoongArch: Use correct accessor to read FWPC/MWPC - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - strparser: Fix signed/unsigned mismatch bug - ksmbd: close accepted socket when per-IP limit rejects connection - gcov: add support for GCC 15 - KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - HID: uclogic: Fix potential memory leak in error path - ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - ARM: dts: imx51-zii-rdu1: Fix audmux node names - arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - mtd: onenand: Pass correct pointer to IRQ handler - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' - lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN - irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - acpi/hmat: Fix lockdep warning for hmem_register_resource() - base/node / ACPI: Enumerate node access class for 'struct access_coordinate' - acpi: numa: Add setting of generic port system locality attributes - acpi: Break out nesting for hmat_parse_locality() - acpi: numa: Add genport target allocation to the HMAT parsing - acpi: numa: Create enum for memory_target access coordinates indexing - base/node / acpi: Change 'node_hmem_attrs' to 'access_coordinates' - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: sysfs: fix leak when nfs_client kobject add fails - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - NFS: enable nconnect for RDMA - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - ASoC: tas2781: fix getting the wrong device number - ASoC: codecs: va-macro: fix resource leak in probe error path - ASoC: cs4271: Fix regulator leak on probe failure - regulator: fixed: fix GPIO descriptor leak on register failure - acpi,srat: Fix incorrect device handle check for Generic Initiator - cifs: Fix uncached read into ITER_KVEC iterator - cifs: stop writeback extension when change of size is detected - Bluetooth: L2CAP: export l2cap_chan_hold for modules - ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - ACPI: CPPC: Check _CPC validity for only the online CPUs - hsr: Fix supervision frame sending on HSRv0 - virtio-net: fix incorrect flags recording in big mode - net_sched: limit try_bulk_dequeue_skb() batches - net/mlx5e: Fix potentially misleading debug message - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix maxrate wraparound in threshold between units - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net_sched: act_connmark: use RCU in tcf_connmark_dump() - wifi: mac80211: skip rate verification for not captured PSDUs - net: mdio: fix resource leak in mdiobus_register_device() - net/handshake: Fix memory leak in tls_handshake_accept() - net/smc: fix mismatch between CLC header and proposal - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - net: fec: correct rx_bytes statistic for the case SHIFT16 is set - selftests: net: local_termination: Wait for interfaces to come up - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - smb/server: fix possible refcount leak in smb2_sess_setup() - smb/server: fix possible memory leak in smb2_read() - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - NFS4: Fix state renewals missing after boot - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - riscv: acpi: avoid errors caused by probing DT devices when ACPI is used - RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - compiler_types: Move unused static inline functions warning to W=2 - iommufd: Make vfio_compat's unmap succeed if the range is already empty - smb: client: fix refcount leak in smb2_set_path_attr - drm/i915: Fix conversion between clock ticks and nanoseconds - drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - selftests: netdevsim: set test timeout to 10 minutes - riscv: stacktrace: fix backtracing through exceptions - drm/amd/display: Fix black screen with HDMI outputs - drm/amdgpu: Fix function header names in amdgpu_connectors.c - extcon: adc-jack: Cleanup wakeup source only if it was enabled - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - x86/microcode/AMD: Add more known models to entry sign checking - drm/amd/display: Enable mst when it's detected but yet to be initialized - net: bridge: fix MST static key usage - lan966x: Fix sleeping in atomic context - net: dsa: microchip: Fix reserved multicast address table programming - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - net/mlx5e: Fix return value in case of module EEPROM read error - net/mlx5e: Use extack in get module eeprom by page callback - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net: dsa: b53: stop reading ARL entries if search is done - net: dsa: b53: fix enabling ip multicast - net: dsa: b53: fix resetting speed and pause on forced link - net: vlan: sync VLAN features with lower device - selftests: netdevsim: Fix ethtool-coalesce.sh fail by installing ethtool-common.sh - netdevsim: add Makefile for selftests - selftests/net: use destination options instead of hop-by-hop - selftests/net: fix GRO coalesce test and add ext header coalesce tests - selftests/net: fix out-of-order delivery of FIN in gro:tcp test - net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro - riscv: stacktrace: Disable KASAN checks for non-current tasks - riscv: Improve exception and system call latency - net: libwx: fix device bus LAN ID - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - ceph: refactor wake_up_bit() pattern of calling - ceph: add checking of wait_for_completion_killable() return value - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - kbuild: uapi: Strip comments before size type check - rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - tools: lib: thermal: use pkg-config to locate libnl3 - tools: lib: thermal: don't preserve owner in install - tools bitmap: Add missing asm-generic/bitsperlong.h include - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - 9p: sysfs_init: don't hardcode error to ENOMEM - cpufreq: tegra186: Initialize all cores to max frequencies - 9p: fix /sys/fs/9p/caches overwriting itself - NTB: epf: Allow arbitrary BAR mapping - clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - clk: at91: clk-sam9x60-pll: force write to PLL_UPDT register - clk: at91: clk-master: Add check for divide by 3 - ARM: at91: pm: save and restore ACR during PLL disable/enable - rtc: pcf2127: clear minute/second interrupt - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - um: Fix help message for ssl-non-raw - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - btrfs: mark dirty extent range for out of bound prealloc extents - RDMA/irdma: Set irdma_cq cq_num field during CQ create - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Fix SD index calculation - ACPICA: Update dsmethod.c to get rid of unused variable warning - char: misc: restrict the dynamic range to exclude reserved minors - smb: client: transport: avoid reconnects triggered by pending task work - ksmbd: use sock_create_kern interface to create kernel socket - orangefs: fix xattr related buffer overflow... - page_pool: Clamp pool size to max 16K pages - 6pack: drop redundant locking and refcounting - exfat: limit log print for IO error - ALSA: usb-audio: add mono main switch to Presonus S1824c - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - net: macb: avoid dealing with endianness in macb_set_hwaddr() - arm64: openeuler_defconfig: enable ras critical related configs by default - rseq: avoid memory access during rseq_get_rseq_cs if task facing critical RAS - futex: avoid memory access during exit_robust_list if task facing critical RAS - mm: avoid memory access during __access_remote_vm if task facing critical RAS - coredump: skip coredump during critical error if task facing critical RAS - exit: terminate process on critical RAS events to prevent further damage - ACPI: APEI: Add MMF_RAS_CRITICAL to mark critical RAS scenarios in mm struct - ACPI: APEI: Add vendor specific error info handling for ARM Processor - mm: memory_failure: fix UAF in memory_failure_cb - genirq: Get rid of global lock in irq_do_set_affinity() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ASoC: stm32: sai: manage context in set_sysclk callback - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - ext4: increase IO priority of fastcommit - accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - accel/habanalabs: return ENOMEM if less than requested pages were pinned - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - net: bridge: Install FDB for bridge MAC on VLAN 0 - NFSv4.1: fix mount hang after CREATE_SESSION failure - NFSv4: handle ERR_GRACE on delegation recalls - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - remoteproc: qcom: q6v5: Avoid handling handover twice - PCI/PM: Skip resuming to D0 if device is disconnected - vfio: return -ENOTTY for unsupported device feature - sparc64: fix prototypes of reads[bwl]() - sparc/module: Add R_SPARC_UA64 relocation handling - r8169: set EEE speed down ratio to 1 - net: intel: fm10k: Fix parameter idx set but not used - wifi: ath10k: Fix connection after GTK rekeying - iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X - net: phy: clear link parameters on admin link down - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - jfs: fix uninitialized waitqueue in transaction manager - jfs: Verify inode mode when loading from disk - ipv6: np->rxpmtu race annotation - f2fs: fix infinite loop in __insert_extent_tree() - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - allow finish_no_open(file, ERR_PTR(-E...)) - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: ufs: core: Disable timestamp functionality if not supported - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency - drm/amdgpu: reject gang submissions under SRIOV - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - ethernet: Extend device_get_mac_address() to use NVMEM - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd: Avoid evicting resources at S5 - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - net/cls_cgroup: Fix task_get_classid() during qdisc run - crypto: caam - double the entropy delay interval for retry - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - crypto: sun8i-ce - remove channel timeout field - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - HID: asus: add Z13 folio to generic group for multitouch to work - selftests: Replace sleep with slowwait - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP - selftests: Disable dad for ipv6 in fcnal-test.sh - x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - netfilter: nf_reject: don't reply to icmp error messages - selftests: traceroute: Use require_command() - media: redrat3: use int type to store negative error codes - selftests: net: replace sleeps in fcnal-test with waits - net: sh_eth: Disable WoL if system can not suspend - phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - phy: renesas: r8a779f0-ether-serdes: add new step added to latest datasheet - phy: cadence: cdns-dphy: Enable lower resolutions in dphy - wifi: mac80211: Fix HE capabilities element check - ntfs3: pretend $Extend records as regular files - scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode changes - net: phy: marvell: Fix 88e1510 downshift counter errata - scsi: ufs: host: mediatek: Enhance recovery on hibernation exit failure - scsi: ufs: host: mediatek: Enhance recovery on resume failure - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - media: ov08x40: Fix the horizontal flip control - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - drm/msm: make sure to not queue up recovery more than once - usb: gadget: f_hid: Fix zero length packet transfer - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amd: add more cyan skillfish PCI ids - iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs - iommu/amd: Skip enabling command/event buffers for kdump - smsc911x: add second read of EEPROM mac when possible corruption seen - net: call cond_resched() less often in __release_sock() - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - media: verisilicon: Explicitly disable selection api ioctls for decoders - media: adv7180: Only validate format in querystd - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Add missing lock in suspend callback - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - dmaengine: dw-edma: Set status for callback_result - dmaengine: mv_xor: match alloc_wc and free_wc - dmaengine: sh: setup_xref error handling - ptp: Limit time setting of PTP clocks - scsi: pm8001: Use int instead of u32 to store error codes - crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - mips: lantiq: danube: rename stp node on EASY50712 reference board - mips: lantiq: xway: sysctrl: rename stp clock - mips: lantiq: danube: add missing device_type in pci node - mips: lantiq: danube: add model to EASY50712 dts - mips: lantiq: danube: add missing properties to cpu node - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - media: fix uninitialized symbol warnings - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - drm/amdkfd: fix vram allocation failure for a special case - fuse: zero initialize inode private data - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - extcon: adc-jack: Fix wakeup source leaks on device unbind - scsi: pm80xx: Fix race condition caused by static variables - scsi: mpi3mr: Fix controller init failure on fault during queue creation - rds: Fix endianness annotation for RDS_MPATH_HASH - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - net: stmmac: Correctly handle Rx checksum offload errors - net: When removing nexthops, don't call synchronize_net if it is not necessary - char: misc: Does not request module for miscdevice with dynamic minor - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - iio: adc: imx93_adc: load calibrated values even calibration failed - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - drm/amdkfd: Handle lack of READ permissions in SVM mapping - drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - scsi: ufs: host: mediatek: Fix invalid access in vccqx handling - scsi: ufs: host: mediatek: Change reset sequence for improved stability - scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO mode change - scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration - bridge: Redirect to backup port when port is administratively down - s390/pci: Use pci_uevent_ers() in PCI recovery - powerpc/eeh: Use result of error_detected() in uevent - ice: Don't use %pK through printk or tracepoints - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for VIDEO_CAMERA_SENSOR - drm/tidss: Set crtc modesetting parameters with adjusted mode - drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST - drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value - drm/tidss: Use the crtc_* timings when programming the HW - media: amphion: Delete v4l2_fh synchronously in .release() - media: pci: ivtv: Don't create fake v4l2_fh - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - wifi: rtw88: sdio: use indirect IO for device registers before power-on - selftests/net: Ensure assert() triggers in psock_tpacket.c - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 - PCI: Disable MSI on RDC PCI to PCIe bridges - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/amd/pm: Use cached metrics data on arcturus - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/display: add more cyan skillfish devices - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/amd/display: ensure committing streams is seamless - mfd: da9063: Split chip variant reading in two bus transactions - mfd: madera: Work around false-positive -Wininitialized warning - mfd: stmpe-i2c: Add missing MODULE_LICENSE - mfd: stmpe: Remove IRQ domain upon removal - tools/power x86_energy_perf_policy: Prefer driver HWP limits - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 - hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - uprobe: Do not emulate/sstep original instruction when ip is changed - nvme: Use non zero KATO for persistent discovery connections - bpf: Clear pfmemalloc flag when freeing all fragments - riscv: bpf: Fix uninitialized symbol 'retval_off' - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel - spi: rpc-if: Add resume support for RZ/G3E - cpuidle: Fail cpuidle device registration if there is one already - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - power: supply: qcom_battmgr: handle charging state change notifications - pmdomain: apple: Add "apple,t8103-pmgr-pwrstate" - tools/cpupower: fix error return value in cpupower_write_sysfs() - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tee: allow a driver to allocate a tee_device without a pool - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - ARM: tegra: transformer-20: fix audio-codec interrupt - ARM: tegra: transformer-20: add missing magnetometer interrupt - soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - arm64: zynqmp: Revert usb node drive strength and slew rate for zcu106 - irqchip/loongson-pch-lpc: Use legacy domain for PCH-LPC IRQ controller - hwmon: sy7636a: add alias - power: supply: sbs-charger: Support multiple devices - pinctrl: keembay: release allocated memory in detach path - hwmon: (sbtsi_temp) AMD CPU extended temperature range support - power: supply: qcom_battmgr: add OOI chemistry - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - selftests/bpf: Upon failures, exit with code 1 in test_xsk.sh - arc: Fix __fls() const-foldability via __builtin_clzl() - cpufreq/longhaul: handle NULL policy in longhaul_exit - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 - irqchip/sifive-plic: Respect mask state when setting affinity - memstick: Add timeout to prevent indefinite waiting - mmc: host: renesas_sdhi: Fix the actual clock - pinctrl: single: fix bias pull up/down handling in pin_config_set - bpf: Don't use %pK through printk - spi: loopback-test: Don't use %pK through printk - soc: qcom: smem: Fix endian-unaware access of num_entries - soc: aspeed: socinfo: Add AST27xx silicon IDs - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Fix race in drm_sched_entity_select_rq() - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - sched/fair: Use all little CPUs for CPU-bound workloads - sched/pelt: Avoid underestimation of task utilization - net: phy: dp83867: Disable EEE support as not implemented - s390/pci: Restore IRQ unconditionally for the zPCI device - regmap: slimbus: fix bus_context pointer in regmap init calls - block: make REQ_OP_ZONE_OPEN a write operation - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - sfc: fix potential memory leak in efx_mae_process_mport() - drm/etnaviv: fix flush sequence logic - Bluetooth: hci_core: Fix tracking of periodic advertisement - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - ASoC: fsl_sai: fix bit order for DSD format - ASoC: Intel: avs: Unprepare a stream when XRUN occurs - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - ALSA: usb-audio: fix control pipe direction - drm/msm/a6xx: Fix GMU firmware parser - wifi: ath12k: free skb during idr cleanup callback - wifi: ath10k: Fix memory leak on unsupported WMI command - ASoC: qdsp6: q6asm: do not sleep while atomic - mptcp: restore window probe - mptcp: drop bogus optimization in __mptcp_check_push() - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS - Bluetooth: rfcomm: fix modem control handling - ACPI: button: Call input_free_device() on failing input device registration - fbdev: atyfb: Check if pll_ops->init_pll failed - net: usb: asix_devices: Check return value of usbnet_get_endpoints - bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - arm64/xcall: add research papers reference in file headers - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: Create jetty with kernel thread - !21713 Fix CVE-2026-23440 - !21683 ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - !21682 Fix CVE-2026-31399 - !21717 sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - !21720 urma: fix bind jetty compat error - !21693 Introduce dmem cgroup - net/mlx5e: Fix race condition during IPSec ESN update - !21712 Fix CVE-2026-23441 - urma: fix bind jetty compat error - !21630 urma: change urma kmod errno - sched/fair: guard WA_SMT with CONFIG_SCHED_SMT in wake_wide() - net/mlx5e: Prevent concurrent access to IPSec ASO context - urma: change urma kmod errno - !21690 urma:delete redundant sub_trans_mode_cap in urma - !21648 RDMA/hns: Fix config the CNP DSCP - !21632 media: dvb-net: fix OOB access in ULE extension header tables - !21692 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma:delete redundant sub_trans_mode_cap in urma - !21696 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21695 urma: Create jetty with kernel thread - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21684 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - urma: Create jetty with kernel thread - !21687 netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - !21685 urma: Create jetty with kernel thread - !21502 urma: bonding support health check - dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig - cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI - cgroup/dmem: avoid pool UAF - cgroup/dmem: avoid rcu warning when unregister region - cgroup/dmem: fix NULL pointer dereference when setting max - cgroup/dmem: Don't open-code css_for_each_descendant_pre - cgroup/rdma: Drop bogus PAGE_COUNTER select - doc/cgroup: Fix title underline length - cgroup/dmem: Fix parameters documentation - kernel/cgroup: Remove the unused variable climit - cgroup/dmem: Select PAGE_COUNTER - kernel/cgroup: Add "dmem" memory accounting cgroup - mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG - mm/page_counter: move calculating protection values to page_counter - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN - urma: Create jetty with kernel thread - urma: bonding support health check - !21520 urma: add software reliability for create and destroy connection - netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove - urma: add software reliability for create and destroy connection - !21668 v4 Reuse SUBSYS for xcu and freezer to preserve KABI - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - ub/ubdevshm: Fix register segment failed issue in multi-thread scenario - nvdimm/bus: Fix potential use after free in asynchronous initialization - !21671 Fix CVE-2026-23269 - !21526 tcp: secure_seq: add back ports to TS offset - !21602 Fix CVE-2026-31408 - !21593 Fix CVE-2026-31393 - !21557 ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression - !21606 ice: Fix memory leak in ice_set_ringparam() - !21645 bpf: Fix regsafe() for pointers to packet - !21667 drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - !21331 AMD Turin Idle HLT and Perf support patches for openEuler 6.6 kernel - !21662 [OLK-6.6]:update patches for sw64 architecture - !21670 urma: change well-known jetty to UM - !21669 urma: adjust netlink log level of ipourma - apparmor: validate DFA start states are in bounds in unpack_pdb - urma: change well-known jetty to UM - urma: adjust netlink log level of ipourma - !21646 icmp: fix NULL pointer dereference in icmp_tag_validation() - !21636 v2 net/sched: Fix CVE-2026-23378 - xSched: update xSched manual for xcu cmdline enable option - xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig - cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 - xSched/cgroup: make xcu.stat invisible at root cgroup - xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI - !21641 Fix CVE-2026-23407 - !21651 spi: fix use-after-free on controller registration failure - !21652 PM: runtime: Fix a race condition related to device removal - !21639 Fix CVE-2026-23406 - !21644 sync OLK-6.6 CVE bugfix LTS from tag 6.6.0-145.0.0 to 6.6.0-146.0.0 - drivers/ub/sentry: add lock for update global variables and change some global variables to local variables - f2fs: fix to detect potential corrupted nid in free_nid_list - ntfs3: Fix uninit buffer allocated by __getname() - nvme-pci: Fix race bug in nvme_poll_irqdisable() - tls: Purge async_hold in tls_decrypt_async_wait() - clsact: Fix use-after-free in init/destroy rollback asymmetry - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - apparmor: fix race between freeing data and fs accessing it - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - urma: fix race condition in async event causing kfree of invalid pointer - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nfnetlink_osf: validate individual option lengths in fingerprints - tls: Fix race condition in tls_sw_cancel_work_tx() - urma: Kernel-mode file for bugfix of vtpn of empty pointer - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - af_unix: Give up GC if MSG_PEEK intervened. - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - apparmor: fix differential encoding verification - ub:hisi-ubus: Synchronize the missing code - apparmor: Fix double free of ns_name in aa_replace_profiles() - mptcp: pm: in-kernel: always mark signal+subflow endp as used - bridge: cfm: Fix race condition in peer_mep deletion - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - apparmor: fix race on rawdata dereference - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net/sched: act_gate: snapshot parameters with RCU on replace - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - netfilter: nf_tables: always walk all pending catchall elements - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - netfilter: nf_tables: unconditionally bump set->nelems before insertion - netfilter: nf_tables: release flowtable after rcu grace period on error - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - netfilter: xt_CT: drop pending enqueued packets on template removal - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - apparmor: fix memory leak in verify_header - wifi: libertas: fix use-after-free in lbs_free_adapter() - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - can: bcm: fix locking for bcm_op runtime updates - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - urma: fix potential deadlock risk in urma_ping - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - net: usb: kalmia: validate USB endpoints - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - urma: use user-specified dev_name when creating agg dev - mm: thp: deny THP for files on anonymous inodes - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !20531 [OLK-6.6] Fix CVE-2025-68315 - !20546 [OLK-6.6] Fix CVE-2025-68727 - !21588 smb/server: fix return values of smb2_0_server_cmds proc - !21506 [OLK-6.6] backport important bugfix for nvme driver from upstream linux-6.6.y - !21551 Fix CVE-2026-23414 - !21549 Fix CVE-2026-23413 - !21611 nf_tables: nft_dynset: fix possible stateful expression memleak in error path - !21610 xdp: Fix CVE-2026-23343 - !21625 Fix CVE-2026-23411 - sw64: fix compile error with missing arch-specific header file - sw64: enable CONFIG_DRM_FBDEV_EMULATION=y as default - !21627 Fix riscv check-build warning - !21412 urma: change well-known jetty to UM - !21623 sched/fair: scale wake_wide() threshold by SMT width - PM: runtime: Fix a race condition related to device removal - spi: fix use-after-free on controller registration failure - !21594 drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - !21629 urma: fix race condition in async event causing kfree of invalid pointer - !21626 urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21618 apparmor: replace recursive profile removal with iterative approach - !21617 apparmor: fix: limit the number of levels of policy namespaces - !21484 Fix CVE-2026-23397 - !21499 Fix CVE-2026-23240 - RDMA/hns: Fix config the CNP DSCP - RDMA/hns: Fix the panic caused by a large number of print - sched/fair: scale wake_wide() threshold by SMT width - sched/core: fix SCHED_FEAT overflow on 32-bit architectures - icmp: fix NULL pointer dereference in icmp_tag_validation() - bpf: Fix regsafe() for pointers to packet - !21635 urma: Kernel-mode file for bugfix of vtpn of empty pointer - !21619 Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() - apparmor: fix side-effect bug in match_char() macro usage - urma: fix race condition in async event causing kfree of invalid pointer - urma: Kernel-mode file for bugfix of vtpn of empty pointer - net/sched: act_ife: Fix metalist update behavior - net/sched: act_ife: avoid possible NULL deref - !21522 af_unix: Give up GC if MSG_PEEK intervened. - !21479 urma: Kernel-mode file for bugfix to move hashtable from alloc to active - media: dvb-net: fix OOB access in ULE extension header tables - !21582 Fix CVE-2026-23409 - urma: change well-known jetty to UM - !21600 ub:hisi-ubus: Synchronize the missing code - !21528 Fix CVE-2026-23408 - Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" - riscv: Replace function-like macro by static inline function - drivers/ub/sentry: fix memory leak in match_dev_by_local_eid() - apparmor: fix race between freeing data and fs accessing it - ub:hisi-ubus: Synchronize the missing code - !21477 Fix CVE-2026-23321 - !21533 Fix CVE-2026-23393 - !21470 Fix CVE-2026-23304 - !21338 drivers/ub/sentry: add oom rate limit - !21517 Fix CVE-2026-23410 - !21550 Fix CVE-2026-23351 - !21560 Fix CVE-2026-23245 - xen/privcmd: add boot control for restricted usage in domU - xen/privcmd: unregister xenstore notifier on module exit - xen/privcmd: restrict usage in unprivileged domU - apparmor: replace recursive profile removal with iterative approach - apparmor: fix: limit the number of levels of policy namespaces - nf_tables: nft_dynset: fix possible stateful expression memleak in error path - xdp: produce a warning when calculated tailroom is negative - xdp: use modulo operation to calculate XDP frag tailroom - ice: Fix memory leak in ice_set_ringparam() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - !21547 Fix CVE-2026-23310 - !21558 Fix CVE-2026-23278 - !21538 Fix CVE-2026-23274 - !21548 Fix CVE-2026-23340 - !21561 Fix CVE-2026-23272 - !21543 Fix CVE-2026-23392 - !21541 Fix CVE-2026-23270 - !21542 Fix CVE-2026-23391 - !21536 Fix CVE-2026-23277 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - !21531 ACPI/IORT: Add PMCG platform information for 162001900 - smb/server: update some misguided comment of smb2_0_server_cmds proc - smb/server: fix return value of smb2_oplock_break() - smb/server: fix return value of smb2_ioctl() - smb/server: fix return value of smb2_query_dir() - smb/server: fix return value of smb2_notify() - smb/server: fix return value of smb2_read() - !21500 regmap: maple: free entry on mas_store_gfp() failure - drivers/ub/sentry: add oom rate limit - apparmor: fix differential encoding verification - !21511 Fix CVE-2026-23403 - !21559 wifi: libertas: fix use-after-free in lbs_free_adapter() - !21554 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - urma: check for null topo map in ubcore_get_topo_info_by_agg_eid - !21567 urma: Kernel-mode file for bugfix deactivate to apply pid in udma - !21556 urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - urma: Kernel-mode file for bugfix deactivate to apply pid in udma - netfilter: nf_tables: unconditionally bump set->nelems before insertion - !21476 Fix CVE-2026-23300 - !21475 Fix CVE-2026-23381 - !21472 Fix CVE-2026-23362 - !21474 Fix CVE-2026-23368 - !21471 Fix CVE-2026-23293 - !21527 CVE-2026-23276 - !21525 net: gro: fix outer network offset - !21524 net: annotate data-races around sk->sk_{data_ready,write_space} - !21523 net: add proper RCU protection to /proc/net/ptype - net/sched: act_gate: snapshot parameters with RCU on replace - wifi: libertas: fix use-after-free in lbs_free_adapter() - netfilter: nf_tables: always walk all pending catchall elements - !21552 nvme-fc: release admin tagset if init fails - ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change - net: tunnel: make skb_vlan_inet_prepare() return drop reasons - urma: Kernel-mode file for bugfix of ubcore_get_route_list in loopback - !21544 urma: fix potential deadlock risk in urma_ping - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - !21486 Fix CVE-2026-23395 - !21480 Fix CVE-2026-23371 - !21507 net: usb: kalmia: validate USB endpoints - nvme-fc: release admin tagset if init fails - tls: Purge async_hold in tls_decrypt_async_wait() - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - urma: Kernel-mode file for bugfix to move hashtable from alloc to active - urma: fix potential deadlock risk in urma_ping - !21516 KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - netfilter: nf_tables: release flowtable after rcu grace period on error - netfilter: xt_CT: drop pending enqueued packets on template removal - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit - bridge: cfm: Fix race condition in peer_mep deletion - !21494 cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - ACPI/IORT: Add PMCG platform information for 162001900 - arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata - !21530 urma: use user-specified dev_name when creating agg dev - urma: use user-specified dev_name when creating agg dev - apparmor: Fix double free of ns_name in aa_replace_profiles() - net: prevent NULL deref in ip[6]tunnel_xmit() - net: add xmit recursion limit to tunnel xmit functions - tcp: secure_seq: add back ports to TS offset - net: gro: fix outer network offset - net: annotate data-races around sk->sk_{data_ready,write_space} - net: add proper RCU protection to /proc/net/ptype - af_unix: Give up GC if MSG_PEEK intervened. - apparmor: fix race on rawdata dereference - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE - apparmor: fix memory leak in verify_header - net: usb: kalmia: validate USB endpoints - !21492 mm: thp: deny THP for files on anonymous inodes - !21491 net: usb: pegasus: validate USB endpoints - nvme-pci: Fix race bug in nvme_poll_irqdisable() - !21466 mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - regmap: maple: free entry on mas_store_gfp() failure - tls: Fix race condition in tls_sw_cancel_work_tx() - !21447 Fix CVE-2026-23303 - !21120 Fix CVE-2026-23231 - !21485 [OLK-6.6][linux-6.6.y sync] Backport 6.6.118-6.6.119 LTS Patches - mm: thp: deny THP for files on anonymous inodes - net: usb: pegasus: validate USB endpoints - cpufreq: CPPC: Use `ktime` to replace `jiffies` to get the system time in cppc_get_perf_ctrs_pair() - !21488 urma: adjust netlink log level of ipourma - !21433 urma: adjust the payload length in the ubcore_cm_send_to function - urma: adjust netlink log level of ipourma - xhci: dbgtty: fix device unregister: fixup - tty: introduce and use tty_port_tty_vhangup() helper - net: dsa: microchip: Fix error path in PTP IRQ setup - can: ucan: Fix infinite loop from zero-length messages - net: dsa: microchip: Free previously initialized ports on init failures - net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}() - tools headers: Update the x86 headers with the kernel sources - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - nfnetlink_osf: validate individual option lengths in fingerprints - selftests: mptcp: join: properly kill background tasks - staging: rtl8712: Remove driver using deprecated API wext - net: macb: fix unregister_netdev call order in macb_remove() - iio: adc: rtq6056: Correct the sign bit index - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - net: dsa: microchip: common: Fix checks on irq_find_mapping() - drm/amd/display: Check NULL before accessing - drm: sti: fix device leaks at component probe - USB: serial: option: add support for Rolling RW101R-GL - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - xhci: dbgtty: fix device unregister - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - usb: dwc3: pci: Sort out the Intel device IDs - usb: dwc3: pci: add support for the Intel Nova Lake -S - usb: renesas_usbhs: Fix synchronous external abort on unbind - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: cdns3: Fix double resource release in cdns3_pci_probe - serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - mptcp: clear scheduled subflows on retransmit - firmware: stratix10-svc: fix bug in saving controller data - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - thunderbolt: Add support for Intel Wildcat Lake - drivers/usb/dwc3: fix PCI parent check - dm-verity: fix unreliable memory allocation - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - can: sja1000: fix max irq loop handling - atm/fore200e: Fix possible data race in fore200e_open() - ARM: dts: nxp: imx6ul: correct SAI3 interrupt line - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - iio: adc: ad7280a: fix ad7280_store_balance_timer() - iio: accel: fix ADXL355 startup race condition - iio: accel: bmc150: Fix irq assumption regression - iio:common:ssp_sensors: Fix an error handling path ssp_probe() - iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields - Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - spi: bcm63xx: fix premature CS deassertion on RX-only transactions - spi: nxp-fspi: Propagate fwnode in ACPI case as well - spi: nxp-fspi: Support per spi-mem operation frequency switches - spi: spi-mem: Add a new controller capability - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors - spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA - mailbox: pcc: don't zero error register - mailbox: mailbox-test: Fix debugfs_create_dir error checking - usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - net: fec: do not register PPS event for PEROUT - net: fec: do not allow enabling PPS and PEROUT simultaneously - net: fec: do not update PEROUT if it is enabled - net: fec: cancel perout_timer when PEROUT is disabled - net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic - net: dsa: sja1105: simplify static configuration reload - net: sxgbe: fix potential NULL dereference in sxgbe_rx() - net: lan966x: Fix the initialization of taprio - net: aquantia: Add missing descriptor cache invalidation on ATL2 - platform/x86: intel: punit_ipc: fix memory corruption - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - !21451 [OLK-6.6][linux-6.6.y sync] Backport 6.6.117-6.6.118 LTS Patches - !21473 net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting - mptcp: pm: in-kernel: always mark signal+subflow endp as used - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock - can: bcm: fix locking for bcm_op runtime updates - net/ipv4:scmtcp: fix unable to release scmtcp sock when sendmsg itself - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - mptcp: fix a race in mptcp_pm_del_add_timer() - HID: amd_sfh: Stop sensor before starting - pmdomain: imx: Fix reference count leak in imx_gpc_remove - pmdomain: imx-gpc: Convert to platform remove callback returning void - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() - uio_hv_generic: Set event for all channels on the device - tracing/tools: Fix incorrcet short option in usage text for --threads - ALSA: usb-audio: fix uac2 clock source at terminal parser - s390/mm: Fix __ptep_rdp() inline assembly - kconfig/nconf: Initialize the default locale at startup - kconfig/mconf: Initialize the default locale at startup - net: tls: Cancel RX async resync request on rcd_delta overflow - selftests: net: use BASH for bareudp testing - x86/microcode/AMD: Limit Entrysign signature checking to known generations - scsi: core: Fix a regression triggered by scsi_host_busy() - cifs: fix typo in enable_gcm_256 module parameter - bcma: don't register devices disabled in OF - LoongArch: Use UAPI types in ptrace UAPI header - pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc() - pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc - platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - s390/ctcm: Fix double-kfree - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: dsa: hellcreek: fix missing error handling in LED registration - drm/tegra: Add call to put_pid() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - xfrm: Prevent locally generated packets from direct output in tunnel mode - xfrm: Determine inner GSO type from packet inner protocol - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Increase DPCD read retries - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/tegra: dc: Fix reference leak in tegra_dc_couple() - mptcp: do not fallback when OoO is present - mptcp: avoid unneeded subflow-level drops - mptcp: fix premature close in case of fallback - mptcp: fix ack generation for fallback msk - mptcp: fix race condition in mptcp_schedule_work() - LoongArch: Don't panic if no valid cache info for PCI - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - MIPS: Malta: Fix !EVA SOC-it PCI MMIO - Input: pegasus-notetaker - fix potential out-of-bounds access - Input: imx_sc_key - fix memory corruption on unload - Input: goodix - add support for ACPI ID GDIX1003 - Input: cros_ec_keyb - fix an invalid memory access - net: dsa: microchip: lan937x: Fix RGMII delay tuning - smb: client: introduce close_cached_dir_locked() - mptcp: Disallow MPTCP subflows from sockmap - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - shmem: fix tmpfs reconfiguration (remount) when noswap is set - mtd: rawnand: cadence: fix DMA device NULL pointer dereference - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - urma: adjust the payload length in the ubcore_cm_send_to function - tools headers: Update the KVM headers with the kernel sources - KVM: SVM: Add Idle HLT intercept support - x86/cpufeatures: Add CPUID feature bit for Idle HLT intercept - perf vendor events amd: Update Zen 5 data cache fill events - perf vendor events amd: Add Zen 5 data fabric metrics - perf vendor events amd: Add Zen 5 data fabric events - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - ntfs3: Fix uninit buffer allocated by __getname() - f2fs: fix to detect potential corrupted nid in free_nid_list